API - Corsair

Every kibana.api.* operation is listed below with parameter shapes and return types from the plugin Zod schemas.

New to Corsair? See API access, authentication, and error handling.

Alerting

createRule

alerting.createRule Create a new alerting rule in Kibana Risk: write

await corsair.kibana.api.alerting.createRule({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—
`body`	`object`	Yes	—

body full type

{
}

Output

Name	Type	Required	Description
`id`	`string`	No	—
`name`	`string`	No	—
`consumer`	`string`	No	—

deleteRule

alerting.deleteRule Delete an alerting rule by ID Risk: destructive

await corsair.kibana.api.alerting.deleteRule({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output: object

Output full type

{
}

listRules

alerting.listRules List alerting rules with pagination and filters Risk: read

await corsair.kibana.api.alerting.listRules({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`search`	`string`	No	—
`filter`	`string`	No	—
`sort_field`	`string`	No	—
`sort_order`	`string`	No	—

Output

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`total`	`number`	No	—
`data`	`object[]`	No	—

data full type

{
}[]

listRuleTypes

alerting.listRuleTypes List available alerting rule types Risk: read

await corsair.kibana.api.alerting.listRuleTypes({});

Input: empty object Output

Name	Type	Required	Description
`rule_types`	`object[]`	No	—

rule_types full type

{
}[]

Cases

create

cases.create Create a new case in Kibana Risk: write

await corsair.kibana.api.cases.create({});

Input

Name	Type	Required	Description
`title`	`string`	Yes	—
`description`	`string`	Yes	—
`owner`	`cases \| observability \| securitySolution`	Yes	—
`connector`	`object`	Yes	—
`settings`	`object`	Yes	—
`tags`	`string[]`	Yes	—
`body`	`object`	No	—

connector full type

{
}

settings full type

{
  syncAlerts: boolean,
  extractObservables?: boolean
}

body full type

{
}

Output

Name	Type	Required	Description
`id`	`string`	No	—
`title`	`string`	No	—
`status`	`string`	No	—

list

cases.list Find and list cases with filters Risk: read

await corsair.kibana.api.cases.list({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`perPage`	`number`	No	—
`search`	`string`	No	—
`status`	`string`	No	—
`severity`	`string`	No	—
`assignees`	`string \| string[]`	No	—
`tags`	`string \| string[]`	No	—
`sortField`	`string`	No	—
`sortOrder`	`string`	No	—

Output

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`total`	`number`	No	—
`cases`	`object[]`	No	—

cases full type

{
}[]

Connectors

create

connectors.create Create a new connector in Kibana Risk: write

await corsair.kibana.api.connectors.create({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—
`connector_type_id`	`string`	Yes	—
`name`	`string`	Yes	—
`config`	`object`	No	—
`secrets`	`object`	No	—

config full type

{
}

secrets full type

{
}

Output

Name	Type	Required	Description
`id`	`string`	No	—
`connector_type_id`	`string`	No	—
`name`	`string`	No	—

delete

connectors.delete Delete a connector by ID Risk: destructive

await corsair.kibana.api.connectors.delete({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output: object

Output full type

{
}

get

connectors.get Retrieve a connector by ID Risk: read

await corsair.kibana.api.connectors.get({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output

Name	Type	Required	Description
`id`	`string`	No	—
`connector_type_id`	`string`	No	—
`name`	`string`	No	—

list

connectors.list List all connectors in Kibana Risk: read

await corsair.kibana.api.connectors.list({});

Input: empty object Output: object[]

Output full type

{
}[]

listTypes

connectors.listTypes List available connector (action) types Risk: read

await corsair.kibana.api.connectors.listTypes({});

Input

Name	Type	Required	Description
`feature_id`	`string`	No	—

Output

Name	Type	Required	Description
`connector_types`	`object[]`	No	—

connector_types full type

{
}[]

Dashboards

create

dashboards.create Create a new dashboard in Kibana Risk: write

await corsair.kibana.api.dashboards.create({});

Input

Name	Type	Required	Description
`title`	`string`	Yes	—
`description`	`string`	No	—
`panels`	`object[]`	No	—
`dashboard_id`	`string`	No	—

panels full type

{
}[]

Output

Name	Type	Required	Description
`id`	`string`	No	—
`title`	`string`	No	—

delete

dashboards.delete Delete a dashboard by ID Risk: destructive

await corsair.kibana.api.dashboards.delete({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output: object

Output full type

{
}

get

dashboards.get Retrieve a dashboard by ID Risk: read

await corsair.kibana.api.dashboards.get({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output

Name	Type	Required	Description
`id`	`string`	No	—
`title`	`string`	No	—

search

dashboards.search Search dashboards in Kibana Risk: read

await corsair.kibana.api.dashboards.search({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—

Output

Name	Type	Required	Description
`data`	`object[]`	No	—
`meta`	`object`	No	—

data full type

{
}[]

meta full type

{
  total?: number,
  page?: number,
  per_page?: number
}

upsert

dashboards.upsert Create or update a dashboard by ID Risk: write

await corsair.kibana.api.dashboards.upsert({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—
`title`	`string`	No	—
`description`	`string`	No	—
`panels`	`object[]`	No	—

panels full type

{
}[]

Output

Name	Type	Required	Description
`id`	`string`	No	—
`title`	`string`	No	—

Data Views

create

dataViews.create Create a new data view in Kibana Risk: write

await corsair.kibana.api.dataViews.create({});

Input

Name	Type	Required	Description
`title`	`string`	Yes	—
`name`	`string`	No	—
`id`	`string`	No	—
`timeFieldName`	`string`	No	—
`override`	`boolean`	No	—

Output

Name	Type	Required	Description
`data_view`	`object`	No	—

data_view full type

{
  id?: string,
  title?: string
}

get

dataViews.get Retrieve data view details by ID Risk: read

await corsair.kibana.api.dataViews.get({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output

Name	Type	Required	Description
`data_view`	`object`	Yes	—

data_view full type

{
  id: string,
  title: string,
  name?: string,
  timeFieldName?: string,
  sourceFilters?: {
  }[]
}

list

dataViews.list List all data views in Kibana Risk: read

await corsair.kibana.api.dataViews.list({});

Input: empty object Output

Name	Type	Required	Description
`data_view`	`object[]`	No	—

data_view full type

{
}[]

Detection

findAlerts

detection.findAlerts Find and aggregate detection alerts Risk: read

await corsair.kibana.api.detection.findAlerts({});

Input

Name	Type	Required	Description
`query`	`object`	No	—
`aggs`	`object`	No	—
`size`	`number`	No	—

query full type

{
}

aggs full type

{
}

Output

Name	Type	Required	Description
`hits`	`object`	No	—
`aggregations`	`object`	No	—
`took`	`number`	No	—
`timed_out`	`boolean`	No	—

hits full type

{
}

aggregations full type

{
}

findRules

detection.findRules Find detection engine rules with filters Risk: read

await corsair.kibana.api.detection.findRules({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`filter`	`string`	No	—
`sort_field`	`string`	No	—
`sort_order`	`string`	No	—
`fields`	`string \| string[]`	No	—

Output

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`total`	`number`	No	—
`data`	`object[]`	No	—

data full type

{
}[]

Fleet

agentPoliciesList

fleet.agentPoliciesList List Fleet agent policies with pagination Risk: read

await corsair.kibana.api.fleet.agentPoliciesList({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`perPage`	`number`	No	—
`kuery`	`string`	No	—
`full`	`boolean`	No	—
`withAgentCount`	`boolean`	No	—
`showUpgradeable`	`boolean`	No	—

Output

Name	Type	Required	Description
`items`	`object[]`	No	—
`total`	`number`	No	—

items full type

{
}[]

agentsSetup

fleet.agentsSetup Check Fleet agents setup status Risk: read

await corsair.kibana.api.fleet.agentsSetup({});

Input: empty object Output

Name	Type	Required	Description
`isReady`	`boolean`	No	—

agentsVersions

fleet.agentsVersions List available Fleet agent versions Risk: read

await corsair.kibana.api.fleet.agentsVersions({});

Input: empty object Output

Name	Type	Required	Description
`items`	`string[]`	No	—

checkPermissions

fleet.checkPermissions Check permissions for the Fleet API Risk: read

await corsair.kibana.api.fleet.checkPermissions({});

Input

Name	Type	Required	Description
`fleetServerSetup`	`boolean`	No	—

Output

Name	Type	Required	Description
`success`	`boolean`	No	—
`error`	`string`	No	—

enrollmentKeyGet

fleet.enrollmentKeyGet Retrieve a Fleet enrollment API key by ID Risk: read

await corsair.kibana.api.fleet.enrollmentKeyGet({});

Input

Name	Type	Required	Description
`keyId`	`string`	Yes	—

Output

Name	Type	Required	Description
`item`	`object`	No	—

item full type

{
}

enrollmentKeysList

fleet.enrollmentKeysList List Fleet enrollment API keys Risk: read

await corsair.kibana.api.fleet.enrollmentKeysList({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`perPage`	`number`	No	—
`kuery`	`string`	No	—

Output

Name	Type	Required	Description
`items`	`object[]`	No	—
`total`	`number`	No	—

items full type

{
}[]

epmCategories

fleet.epmCategories List Fleet EPM package categories Risk: read

await corsair.kibana.api.fleet.epmCategories({});

Input

Name	Type	Required	Description
`prerelease`	`boolean`	No	—

Output

Name	Type	Required	Description
`response`	`object[]`	No	—

response full type

{
}[]

epmDataStreams

fleet.epmDataStreams List Fleet EPM data streams Risk: read

await corsair.kibana.api.fleet.epmDataStreams({});

Input

Name	Type	Required	Description
`type`	`string`	No	—
`datasetQuery`	`string`	No	—

Output

Name	Type	Required	Description
`data_streams`	`object[]`	No	—

data_streams full type

{
}[]

epmPackageDetails

fleet.epmPackageDetails Retrieve details of a Fleet EPM package version Risk: read

await corsair.kibana.api.fleet.epmPackageDetails({});

Input

Name	Type	Required	Description
`pkgName`	`string`	Yes	—
`pkgVersion`	`string`	Yes	—
`full`	`boolean`	No	—

Output

Name	Type	Required	Description
`response`	`object`	No	—

response full type

{
}

epmPackageFile

fleet.epmPackageFile Retrieve a file from a Fleet EPM package Risk: read

await corsair.kibana.api.fleet.epmPackageFile({});

Input

Name	Type	Required	Description
`pkgName`	`string`	Yes	—
`pkgVersion`	`string`	Yes	—
`filePath`	`string`	Yes	—

Output: empty object

epmPackagesInstalled

fleet.epmPackagesInstalled List installed Fleet EPM packages Risk: read

await corsair.kibana.api.fleet.epmPackagesInstalled({});

Input

Name	Type	Required	Description
`nameQuery`	`string`	No	—
`perPage`	`number`	No	—

Output

Name	Type	Required	Description
`response`	`object[]`	No	—

response full type

{
}[]

epmPackagesLimited

fleet.epmPackagesLimited List Fleet EPM package names only Risk: read

await corsair.kibana.api.fleet.epmPackagesLimited({});

Input: empty object Output

Name	Type	Required	Description
`response`	`string[]`	No	—

epmPackagesList

fleet.epmPackagesList List available Fleet EPM packages Risk: read

await corsair.kibana.api.fleet.epmPackagesList({});

Input: empty object Output

Name	Type	Required	Description
`response`	`object[]`	No	—

response full type

{
}[]

epmPackageStats

fleet.epmPackageStats Retrieve usage statistics for a Fleet package Risk: read

await corsair.kibana.api.fleet.epmPackageStats({});

Input

Name	Type	Required	Description
`pkgName`	`string`	Yes	—

Output

Name	Type	Required	Description
`response`	`object`	No	—

response full type

{
}

outputDelete

fleet.outputDelete Delete a Fleet output by ID Risk: destructive

await corsair.kibana.api.fleet.outputDelete({});

Input

Name	Type	Required	Description
`outputId`	`string`	Yes	—

Output: object

Output full type

{
}

packagePoliciesList

fleet.packagePoliciesList List Fleet package policies with pagination Risk: read

await corsair.kibana.api.fleet.packagePoliciesList({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`perPage`	`number`	No	—
`kuery`	`string`	No	—
`withAgentCount`	`boolean`	No	—
`showUpgradeable`	`boolean`	No	—

Output

Name	Type	Required	Description
`items`	`object[]`	No	—
`total`	`number`	No	—

items full type

{
}[]

proxyDelete

fleet.proxyDelete Delete a Fleet proxy by ID Risk: destructive

await corsair.kibana.api.fleet.proxyDelete({});

Input

Name	Type	Required	Description
`itemId`	`string`	Yes	—

Output: object

Output full type

{
}

serverHostGet

fleet.serverHostGet Retrieve a Fleet Server host by ID Risk: read

await corsair.kibana.api.fleet.serverHostGet({});

Input

Name	Type	Required	Description
`itemId`	`string`	Yes	—

Output

Name	Type	Required	Description
`item`	`object`	No	—

item full type

{
}

serverHostsList

fleet.serverHostsList List Fleet Server hosts Risk: read

await corsair.kibana.api.fleet.serverHostsList({});

Input: empty object Output

Name	Type	Required	Description
`items`	`object[]`	No	—

items full type

{
}[]

Index

listIndices

index.listIndices List indices via Index Management (not in the official OpenAPI spec; disabled on serverless, works where Index Management UI is enabled) Risk: read

await corsair.kibana.api.index.listIndices({});

Input

Name	Type	Required	Description
`index`	`string`	No	—

Output

Name	Type	Required	Description
`indices`	`object[]`	No	—

indices full type

{
}[]

Lists

delete

lists.delete Delete a value list by ID Risk: destructive

await corsair.kibana.api.lists.delete({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—
`deleteReferences`	`boolean`	No	—
`ignoreReferences`	`boolean`	No	—

Output: object

Output full type

{
}

Metrics

get

metrics.get Retrieve Elasticsearch node metrics Risk: read

await corsair.kibana.api.metrics.get({});

Input

Name	Type	Required	Description
`node_id`	`string`	No	—
`metric`	`string \| string[]`	No	—

Output

Name	Type	Required	Description
`nodes`	`object`	No	—

nodes full type

{
}

Osquery

deleteSavedQuery

osquery.deleteSavedQuery Delete an Osquery saved query by ID Risk: destructive

await corsair.kibana.api.osquery.deleteSavedQuery({});

Input

Name	Type	Required	Description
`id`	`string`	Yes	—

Output: object

Output full type

{
}

Reporting

listJobs

reporting.listJobs List Kibana reporting jobs (legacy stateful-only API; not in the official OpenAPI spec, 404 on serverless) Risk: read

await corsair.kibana.api.reporting.listJobs({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—

Output

Name	Type	Required	Description
`jobs`	`object[]`	No	—
`total`	`number`	No	—

jobs full type

{
}[]

Saved Objects

create

savedObjects.create Create a new saved object in Kibana Risk: write

await corsair.kibana.api.savedObjects.create({});

Input

Name	Type	Required	Description
`type`	`string`	Yes	—
`id`	`string`	No	—
`attributes`	`object`	Yes	—
`references`	`object[]`	No	—
`overwrite`	`boolean`	No	—

attributes full type

{
}

references full type

{
}[]

Output

Name	Type	Required	Description
`id`	`string`	Yes	—
`type`	`string`	Yes	—
`attributes`	`object`	Yes	—
`references`	`object[]`	No	—
`updated_at`	`string`	No	—
`version`	`string`	No	—

attributes full type

{
}

references full type

{
}[]

delete

savedObjects.delete Delete a saved object by type and ID Risk: destructive

await corsair.kibana.api.savedObjects.delete({});

Input

Name	Type	Required	Description
`type`	`string`	Yes	—
`id`	`string`	Yes	—

Output: object

Output full type

{
}

find

savedObjects.find Find saved objects matching search query or type filters Risk: read

await corsair.kibana.api.savedObjects.find({});

Input

Name	Type	Required	Description
`type`	`string \| string[]`	Yes	—
`search`	`string`	No	—
`page`	`number`	No	—
`per_page`	`number`	No	—
`sort_field`	`string`	No	—
`has_reference`	`object`	No	—

has_reference full type

{
  type: string,
  id: string
}

Output

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`total`	`number`	Yes	—
`saved_objects`	`object[]`	Yes	—

saved_objects full type

{
  id: string,
  type: string,
  attributes: {
  },
  references?: {
  }[],
  updated_at?: string,
  version?: string
}[]

get

savedObjects.get Retrieve a specific saved object by type and ID Risk: read

await corsair.kibana.api.savedObjects.get({});

Input

Name	Type	Required	Description
`type`	`string`	Yes	—
`id`	`string`	Yes	—

Output

Name	Type	Required	Description
`id`	`string`	Yes	—
`type`	`string`	Yes	—
`attributes`	`object`	Yes	—
`references`	`object[]`	No	—
`updated_at`	`string`	No	—
`version`	`string`	No	—

attributes full type

{
}

references full type

{
}[]

update

savedObjects.update Update attributes of an existing saved object by type and ID Risk: write

await corsair.kibana.api.savedObjects.update({});

Input

Name	Type	Required	Description
`type`	`string`	Yes	—
`id`	`string`	Yes	—
`attributes`	`object`	Yes	—
`references`	`object[]`	No	—

attributes full type

{
}

references full type

{
}[]

Output

Name	Type	Required	Description
`id`	`string`	Yes	—
`type`	`string`	Yes	—
`attributes`	`object`	Yes	—
`references`	`object[]`	No	—
`updated_at`	`string`	No	—
`version`	`string`	No	—

attributes full type

{
}

references full type

{
}[]

Security

entitiesList

security.entitiesList List Entity Store entities Risk: read

await corsair.kibana.api.security.entitiesList({});

Input

Name	Type	Required	Description
`filter`	`string`	No	—
`filterQuery`	`string`	No	—
`page`	`number`	No	—
`per_page`	`number`	No	—
`size`	`number`	No	—
`searchAfter`	`string`	No	—
`source`	`string \| string[]`	No	—
`fields`	`string \| string[]`	No	—
`sort_field`	`string`	No	—
`sort_order`	`string`	No	—
`entity_types`	`string \| string[]`	No	—

Output

Name	Type	Required	Description
`records`	`object[]`	No	—
`total`	`number`	No	—

records full type

{
}[]

entityStoreEngines

security.entityStoreEngines Retrieve Entity Store engines (derived from the entity-store status response; no separate engines endpoint exists in the spec) Risk: read

await corsair.kibana.api.security.entityStoreEngines({});

Input: empty object Output

Name	Type	Required	Description
`engines`	`object[]`	No	—

engines full type

{
}[]

entityStoreStatus

security.entityStoreStatus Retrieve Entity Store status Risk: read

await corsair.kibana.api.security.entityStoreStatus({});

Input

Name	Type	Required	Description
`include_components`	`boolean`	No	—

Output

Name	Type	Required	Description
`status`	`string`	No	—
`engines`	`object[]`	No	—

engines full type

{
}[]

listEndpointItems

security.listEndpointItems List Endpoint exception list items Risk: read

await corsair.kibana.api.security.listEndpointItems({});

Input

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`filter`	`string`	No	—
`sort_field`	`string`	No	—
`sort_order`	`string`	No	—

Output

Name	Type	Required	Description
`page`	`number`	No	—
`per_page`	`number`	No	—
`total`	`number`	No	—
`data`	`object[]`	No	—

data full type

{
}[]

Status

get

status.get Retrieve health and version status of the Kibana instance Risk: read

await corsair.kibana.api.status.get({});

Input: empty object Output

Name	Type	Required	Description
`name`	`string`	No	—
`version`	`object`	No	—
`status`	`object`	No	—

version full type

{
  number?: string,
  build_hash?: string,
  build_number?: number,
  build_snapshot?: boolean
}

status full type

{
  overall?: {
    state?: string,
    title?: string,
    nickname?: string
  }
}

​Alerting

​createRule

​deleteRule

​listRules

​listRuleTypes

​Cases

​create

​list

​Connectors

​create

​delete

​get

​list

​listTypes

​Dashboards

​create

​delete

​get

​search

​upsert

​Data Views

​create

​get

​list

​Detection

​findAlerts

​findRules

​Fleet

​agentPoliciesList

​agentsSetup

​agentsVersions

​checkPermissions

​enrollmentKeyGet

​enrollmentKeysList

​epmCategories

​epmDataStreams

​epmPackageDetails

​epmPackageFile

​epmPackagesInstalled

​epmPackagesLimited

​epmPackagesList

​epmPackageStats

​outputDelete

​packagePoliciesList

​proxyDelete

​serverHostGet

​serverHostsList

​Index

​listIndices

​Lists

​delete

​Metrics

​get

​Osquery

​deleteSavedQuery

​Reporting

​listJobs

​Saved Objects

​create

​delete

​find

​get

​update

​Security

​entitiesList

​entityStoreEngines

​entityStoreStatus

​listEndpointItems

​Status

​get

Alerting

createRule

deleteRule

listRules

listRuleTypes

Cases

create

list

Connectors

create

delete

get

list

listTypes

Dashboards

create

delete

get

search

upsert

Data Views

create

get

list

Detection

findAlerts

findRules

Fleet

agentPoliciesList

agentsSetup

agentsVersions

checkPermissions

enrollmentKeyGet

enrollmentKeysList

epmCategories

epmDataStreams

epmPackageDetails

epmPackageFile

epmPackagesInstalled

epmPackagesLimited

epmPackagesList

epmPackageStats

outputDelete

packagePoliciesList

proxyDelete

serverHostGet

serverHostsList

Index

listIndices

Lists

delete

Metrics

get

Osquery

deleteSavedQuery

Reporting

listJobs

Saved Objects

create

delete

find

get

update

Security

entitiesList

entityStoreEngines

entityStoreStatus

listEndpointItems

Status

get