Need help with your APIs? I offer API discovery, governance & evangelism services. Explore services →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Kibana Security Lists API API

Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.Lists are made up of:* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used: * `boolean` * `byte` * `date` * `date_nanos` * `date_range` * `double` * `double_range` * `float` * `float_range` * `half_float` * `integer` * `integer_range` * `ip` * `ip_range` * `keyword` * `long` * `long_range` * `short` * `text`* **List items**: The values used to determine whether the exception prevents an alert from being generated.All list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:1. `192.168.1.1`2. `192.168.1.3`3. `192.168.1.18`4. `192.168.1.12`5. `192.168.1.7`To use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.> info> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.## Lists requirementsBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.

Kibana Security Lists API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Lists API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

This API exposes 18 operations across 8 paths, and defines 20 schemas. It is described by OpenAPI 3.0.3.

Requests are made against a single base URL, https://{kibana_url}.

18 operations 8 paths 20 schemas 3 DELETE6 GET2 PATCH5 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.3
Base URL
https://localhost:5601/api
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Kibana Security Lists API API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 18

Across 8 paths, the API surfaces 18 operations — 3 DELETE, 6 GET, 2 PATCH, 5 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Security Lists API 18

Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts. Lists are made up of: List containers: A container for values of the…

DELETE
/api/lists
Delete a value list
DeleteList 3 params → 200400401403404500
GET
/api/lists
Get value list details
ReadList 1 param → 200400401403404500
PATCH
/api/lists
Patch a value list
PatchList body → 200400401403404500
POST
/api/lists
Create a value list
CreateList body → 200400401403409500
PUT
/api/lists
Update a value list
UpdateList body → 200400401403404500
GET
/api/lists/_find
Get value lists
FindLists 6 params → 200400401403500
DELETE
/api/lists/index
Delete value list data streams
DeleteListIndex → 200400401403404500
GET
/api/lists/index
Get status of value list data streams
ReadListIndex → 200400401403404500
POST
/api/lists/indexdeprecated
Create list data streams
CreateListIndex → 200400401403409500
DELETE
/api/lists/items
Delete a value list item
DeleteListItem 4 params → 200400401403404500
GET
/api/lists/items
Get a value list item
ReadListItem 3 params → 200400401403404500
PATCH
/api/lists/items
Patch a value list item
PatchListItem body → 200400401403404500
POST
/api/lists/items
Create a value list item
CreateListItem body → 200400401403404409500
PUT
/api/lists/items
Update a value list item
UpdateListItem body → 200400401403404500
POST
/api/lists/items/_export
Export value list items
ExportListItems 1 param → 200400401403404500
GET
/api/lists/items/_find
Get value list items
FindListItems 7 params → 200400401403500
POST
/api/lists/items/_import
Import value list items
ImportListItems 3 params body → 200400401403409500
GET
/api/lists/privileges
Get value list privileges
ReadListPrivileges → 200400401403500

Schemas 20

The contract defines 20 schemas that model the data the API accepts and returns. The most detailed are Security_Lists_API_List (14 properties), Security_Lists_API_ListItem (12 properties), Security_Lists_API_ListItemPrivileges (5 properties), Security_Lists_API_ListPrivileges (5 properties). Each schema is shown below with its type and property counts.

Security_Lists_API_FindListsFilter
string
Security_Lists_API_ListMetadata
object
Placeholder for metadata about the value list.
Security_Lists_API_ListName
string
Value list's name.
Security_Lists_API_ListId
string
Value list's identifier.
Security_Lists_API_ListDescription
string
Describes the value list.
Security_Lists_API_ListItemId
string
Value list item's identifier.
Security_Lists_API_ListItemMetadata
object
Placeholder for metadata about the value list item.
Security_Lists_API_ListPrivileges
object
5 properties 5 required
Security_Lists_API_ListType
string
Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - keyword: Many ECS fields are Elasticsearch keywords - ip: I…
Security_Lists_API_FindListItemsCursor
string
Returns the items that come after the last item returned in the previous call (use the cursor value returned in the previous call). This parameter uses the tie…
Security_Lists_API_SiemErrorResponse
object
2 properties 2 required
Security_Lists_API_FindListItemsFilter
string
Security_Lists_API_ListItemValue
string
The value used to evaluate exceptions.
Security_Lists_API_ListVersion
integer
The document version number.
Security_Lists_API_ListItem
object
12 properties 9 required
Security_Lists_API_ListVersionId
string
The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
Security_Lists_API_FindListsCursor
string
Security_Lists_API_PlatformErrorResponse
object
3 properties 3 required
Security_Lists_API_ListItemPrivileges
object
5 properties 5 required
Security_Lists_API_List
object
14 properties 11 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kibana-security-lists-api-api-openapi.yml Raw ↑

Other APIs Kibana publishes across the network.

Kibana Actions API
Kibana agent builder API
Kibana alerting API
Kibana APM agent configuration API
Kibana APM agent keys API
Kibana APM annotations API
Kibana APM server schema API
Kibana APM sourcemaps API
Kibana cases API
Kibana connectors API
Kibana Data streams API
Kibana data views API