Applies a bulk action to multiple Knowledge Base Entries

POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action

The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.

application/json

Body

create array[object]

List of Knowledge Base Entries to create.
Any of:
Security_AI_Assistant_API_DocumentEntryCreateFields object Security_AI_Assistant_API_IndexEntryCreateFields object
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false.

name string Required

Name of the Knowledge Base Entry.

namespace string

Kibana Space, defaults to 'default' space.

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID.

Hide users attributes Show users attributes object

id string

User id.

name string

User name.

kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.

Values are security_labs or user.

source string Required

Source document name or filepath.

text string Required

Knowledge Base Entry content.

type string Required Discriminator

Entry type.

Value is document.

required boolean

Whether this resource should always be included, defaults to false.

vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

Hide vector attributes Show vector attributes object

modelId string Required

ID of the model used to create the embeddings.

tokens object Required

Tokens with their corresponding values.

Hide tokens attribute Show tokens attribute object

* number Additional properties
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false.

name string Required

Name of the Knowledge Base Entry.

namespace string

Kibana Space, defaults to 'default' space.

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID.

Hide users attributes Show users attributes object

id string

User id.

name string

User name.

description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.

field string Required

Field to query for Knowledge Base content.

index string Required

Index or Data Stream to query for Knowledge Base content.

queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.

type string Required Discriminator

Entry type.

Value is index.

inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.

Hide inputSchema attributes Show inputSchema attributes object

description string Required

Description of the field.

fieldName string Required

Name of the field.

fieldType string Required

Type of the field.

outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty.
delete object
Hide delete attributes Show delete attributes object
- ids array[string]
  
  Array of Knowledge Base Entry IDs.
  
  At least 1 element.
- query string
  
  Query to filter Knowledge Base Entries.
update array[object]

List of Knowledge Base Entries to update.
Any of:
Security_AI_Assistant_API_DocumentEntryCreateFields object Security_AI_Assistant_API_IndexEntryCreateFields object
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false.

id string(nonempty) Required

The ID of the anonymization field.

Minimum length is 1.

name string Required

Name of the Knowledge Base Entry.

namespace string

Kibana Space, defaults to 'default' space.

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID.

Hide users attributes Show users attributes object

id string

User id.

name string

User name.

kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.

Values are security_labs or user.

source string Required

Source document name or filepath.

text string Required

Knowledge Base Entry content.

type string Required Discriminator

Entry type.

Value is document.

required boolean

Whether this resource should always be included, defaults to false.

vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

Hide vector attributes Show vector attributes object

modelId string Required

ID of the model used to create the embeddings.

tokens object Required

Tokens with their corresponding values.

Hide tokens attribute Show tokens attribute object

* number Additional properties
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false.

id string(nonempty) Required

The ID of the anonymization field.

Minimum length is 1.

name string Required

Name of the Knowledge Base Entry.

namespace string

Kibana Space, defaults to 'default' space.

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID.

Hide users attributes Show users attributes object

id string

User id.

name string

User name.

description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.

field string Required

Field to query for Knowledge Base content.

index string Required

Index or Data Stream to query for Knowledge Base content.

queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.

type string Required Discriminator

Entry type.

Value is index.

inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.

Hide inputSchema attributes Show inputSchema attributes object

description string Required

Description of the field.

fieldName string Required

Name of the field.

fieldType string Required

Type of the field.

outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty.

Responses

200 application/json

Successful bulk operation request
Hide response attributes Show response attributes object
- attributes object Required
  
  Hide attributes attributes Show attributes attributes object
  
  errors array[object]
  
  List of errors encountered during the bulk action.
  
  Hide errors attributes Show errors attributes object
  
  err_code string
  
  Specific error code for the issue.
  
  knowledgeBaseEntries array[object] Required
  
  List of Knowledge Base Entries that encountered the error.
  
  Hide knowledgeBaseEntries attributes Show knowledgeBaseEntries attributes object
  
  id string Required
  
  ID of the Knowledge Base Entry that encountered an error.
  
  name string
  
  Name of the Knowledge Base Entry that encountered an error.
  
  message string Required
  
  Error message describing the issue.
  
  statusCode integer Required
  
  HTTP status code associated with the error.
  
  results object Required
  
  Hide results attributes Show results attributes object
  
  created array[object] Required
  
  List of Knowledge Base Entries that were successfully created.
  
  Any of:
  Security_AI_Assistant_API_DocumentEntryResponseFields object Security_AI_Assistant_API_IndexEntryResponseFields object
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false.
  
  name string Required
  
  Name of the Knowledge Base Entry.
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space.
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID.
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id.
  
  name string
  
  User name.
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created.
  
  createdBy string Required
  
  User who created the Knowledge Base Entry.
  
  id string(nonempty) Required
  
  The ID of the anonymization field.
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated.
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry.
  
  kbResource string Required
  
  Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
  
  Values are security_labs or user.
  
  source string Required
  
  Source document name or filepath.
  
  text string Required
  
  Knowledge Base Entry content.
  
  type string Required Discriminator
  
  Entry type.
  
  Value is document.
  
  required boolean
  
  Whether this resource should always be included, defaults to false.
  
  vector object
  
  Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
  
  Hide vector attributes Show vector attributes object
  
  modelId string Required
  
  ID of the model used to create the embeddings.
  
  tokens object Required
  
  Tokens with their corresponding values.
  
  Hide tokens attribute Show tokens attribute object
  
  * number Additional properties
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false.
  
  name string Required
  
  Name of the Knowledge Base Entry.
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space.
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID.
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id.
  
  name string
  
  User name.
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created.
  
  createdBy string Required
  
  User who created the Knowledge Base Entry.
  
  id string(nonempty) Required
  
  The ID of the anonymization field.
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated.
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry.
  
  description string Required
  
  Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
  
  field string Required
  
  Field to query for Knowledge Base content.
  
  index string Required
  
  Index or Data Stream to query for Knowledge Base content.
  
  queryDescription string Required
  
  Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
  
  type string Required Discriminator
  
  Entry type.
  
  Value is index.
  
  inputSchema array[object]
  
  Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
  
  Hide inputSchema attributes Show inputSchema attributes object
  
  description string Required
  
  Description of the field.
  
  fieldName string Required
  
  Name of the field.
  
  fieldType string Required
  
  Type of the field.
  
  outputFields array[string]
  
  Fields to extract from the query result, defaults to all fields if not provided or empty.
  
  deleted array[string] Required
  
  List of IDs of Knowledge Base Entries that were successfully deleted.
  
  skipped array[object] Required
  
  List of Knowledge Base Entries that were skipped during the bulk action.
  
  Hide skipped attributes Show skipped attributes object
  
  id string Required
  
  ID of the skipped Knowledge Base Entry.
  
  name string
  
  Name of the skipped Knowledge Base Entry.
  
  skip_reason string Required
  
  Reason why a Knowledge Base Entry was skipped during the bulk action.
  
  Value is KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED.
  
  updated array[object] Required
  
  List of Knowledge Base Entries that were successfully updated.
  
  Any of:
  Security_AI_Assistant_API_DocumentEntryResponseFields object Security_AI_Assistant_API_IndexEntryResponseFields object
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false.
  
  name string Required
  
  Name of the Knowledge Base Entry.
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space.
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID.
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id.
  
  name string
  
  User name.
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created.
  
  createdBy string Required
  
  User who created the Knowledge Base Entry.
  
  id string(nonempty) Required
  
  The ID of the anonymization field.
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated.
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry.
  
  kbResource string Required
  
  Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
  
  Values are security_labs or user.
  
  source string Required
  
  Source document name or filepath.
  
  text string Required
  
  Knowledge Base Entry content.
  
  type string Required Discriminator
  
  Entry type.
  
  Value is document.
  
  required boolean
  
  Whether this resource should always be included, defaults to false.
  
  vector object
  
  Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
  
  Hide vector attributes Show vector attributes object
  
  modelId string Required
  
  ID of the model used to create the embeddings.
  
  tokens object Required
  
  Tokens with their corresponding values.
  
  Hide tokens attribute Show tokens attribute object
  
  * number Additional properties
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false.
  
  name string Required
  
  Name of the Knowledge Base Entry.
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space.
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID.
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id.
  
  name string
  
  User name.
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created.
  
  createdBy string Required
  
  User who created the Knowledge Base Entry.
  
  id string(nonempty) Required
  
  The ID of the anonymization field.
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated.
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry.
  
  description string Required
  
  Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
  
  field string Required
  
  Field to query for Knowledge Base content.
  
  index string Required
  
  Index or Data Stream to query for Knowledge Base content.
  
  queryDescription string Required
  
  Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
  
  type string Required Discriminator
  
  Entry type.
  
  Value is index.
  
  inputSchema array[object]
  
  Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
  
  Hide inputSchema attributes Show inputSchema attributes object
  
  description string Required
  
  Description of the field.
  
  fieldName string Required
  
  Name of the field.
  
  fieldType string Required
  
  Type of the field.
  
  outputFields array[string]
  
  Fields to extract from the query result, defaults to all fields if not provided or empty.
  
  summary object Required
  
  Hide summary attributes Show summary attributes object
  
  failed integer Required
  
  Number of Knowledge Base Entries that failed during the bulk action.
  
  skipped integer Required
  
  Number of Knowledge Base Entries that were skipped during the bulk action.
  
  succeeded integer Required
  
  Number of Knowledge Base Entries that were successfully processed during the bulk action.
  
  total integer Required
  
  Total number of Knowledge Base Entries involved in the bulk action.
- knowledgeBaseEntriesCount integer
  
  Total number of Knowledge Base Entries processed.
- message string
  
  Message describing the result of the bulk action.
- statusCode integer
  
  HTTP status code of the response.
- success boolean
  
  Indicates whether the bulk action was successful.
400 application/json

Generic Error
Hide response attributes Show response attributes object
- error string Required
  
  Error type or category.
- message string Required
  
  Detailed error message.
- statusCode number Required
  
  HTTP status code of the error.

POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action

curl \
 --request POST 'https://<KIBANA_URL>/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"create":[{"title":"New Entry","content":"This is the content of the new entry."}],"delete":{"ids":["123","456","789"],"query":"status:active AND category:technology"},"update":[{"id":"123","title":"Updated Entry","content":"Updated content."}]}'