Kibana

Access Kibana saved objects, dashboards, data views, spaces, alerts, and fleet via managed API authentication.

Quick Start

python \x3C\x3C'EOF'
import urllib.request, os, json
req = urllib.request.Request('https://gateway.maton.ai/kibana/api/saved_objects/_find?type=dashboard')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
req.add_header('kbn-xsrf', 'true')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF

Base URL

https://gateway.maton.ai/kibana/{native-api-path}

The gateway proxies requests to your Kibana instance and automatically injects authentication.

Authentication

All requests require the Maton API key and the kbn-xsrf header:

Authorization: Bearer $MATON_API_KEY
kbn-xsrf: true

Environment Variable: Set your API key as MATON_API_KEY:

export MATON_API_KEY="YOUR_API_KEY"

Getting Your API Key

1. Sign in or create an account at maton.ai
2. Go to maton.ai/settings
3. Copy your API key

Connection Management

Manage your Kibana connections at https://ctrl.maton.ai.

List Connections

python \x3C\x3C'EOF'
import urllib.request, os, json
req = urllib.request.Request('https://ctrl.maton.ai/connections?app=kibana&status=ACTIVE')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF

Create Connection

python \x3C\x3C'EOF'
import urllib.request, os, json
data = json.dumps({'app': 'kibana'}).encode()
req = urllib.request.Request('https://ctrl.maton.ai/connections', data=data, method='POST')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
req.add_header('Content-Type', 'application/json')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF

Open the returned url in a browser to complete authentication. You'll need to provide your Kibana API key.

Delete Connection

python \x3C\x3C'EOF'
import urllib.request, os, json
req = urllib.request.Request('https://ctrl.maton.ai/connections/{connection_id}', method='DELETE')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF

API Reference

Important: All Kibana API requests require the kbn-xsrf: true header.

Status & Features

Get Status

GET /kibana/api/status

Response:

{
  "name": "kibana",
  "uuid": "abc123",
  "version": {
    "number": "8.15.0",
    "build_hash": "..."
  },
  "status": {
    "overall": {"level": "available"}
  }
}

List Features

GET /kibana/api/features

Returns list of all Kibana features and their capabilities.

Saved Objects

Find Saved Objects

GET /kibana/api/saved_objects/_find?type={type}

Query Parameters:

• type - Object type: dashboard, visualization, index-pattern, search, lens, map
• search - Search query
• page - Page number
• per_page - Results per page (default 20, max 10000)
• fields - Fields to return

Response:

{
  "page": 1,
  "per_page": 20,
  "total": 5,
  "saved_objects": [
    {
      "id": "abc123",
      "type": "dashboard",
      "attributes": {
        "title": "My Dashboard",
        "description": "Dashboard description"
      },
      "version": "1",
      "updated_at": "2024-01-01T00:00:00.000Z"
    }
  ]
}

Get Saved Object

GET /kibana/api/saved_objects/{type}/{id}

Create Saved Object

POST /kibana/api/saved_objects/{type}/{id}
Content-Type: application/json

{
  "attributes": {
    "title": "My Index Pattern",
    "timeFieldName": "@timestamp"
  }
}

Update Saved Object

PUT /kibana/api/saved_objects/{type}/{id}
Content-Type: application/json

{
  "attributes": {
    "title": "Updated Title"
  }
}

Delete Saved Object

DELETE /kibana/api/saved_objects/{type}/{id}

Bulk Operations

POST /kibana/api/saved_objects/_bulk_get
Content-Type: application/json

[
  {"type": "dashboard", "id": "abc123"},
  {"type": "visualization", "id": "def456"}
]

Data Views

List Data Views

GET /kibana/api/data_views

Response:

{
  "data_view": [
    {
      "id": "abc123",
      "title": "logs-*",
      "timeFieldName": "@timestamp"
    }
  ]
}

Get Data View

GET /kibana/api/data_views/data_view/{id}

Create Data View

POST /kibana/api/data_views/data_view
Content-Type: application/json

{
  "data_view": {
    "title": "logs-*",
    "timeFieldName": "@timestamp"
  }
}

Response:

{
  "data_view": {
    "id": "abc123",
    "title": "logs-*",
    "timeFieldName": "@timestamp"
  }
}

Update Data View

POST /kibana/api/data_views/data_view/{id}
Content-Type: application/json

{
  "data_view": {
    "title": "updated-logs-*"
  }
}

Delete Data View

DELETE /kibana/api/data_views/data_view/{id}

Spaces

List Spaces

GET /kibana/api/spaces/space

Response:

[
  {
    "id": "default",
    "name": "Default",
    "description": "Default space",
    "disabledFeatures": []
  }
]

Get Space

GET /kibana/api/spaces/space/{id}

Create Space

POST /kibana/api/spaces/space
Content-Type: application/json

{
  "id": "marketing",
  "name": "Marketing",
  "description": "Marketing team space",
  "disabledFeatures": []
}

Update Space

PUT /kibana/api/spaces/space/{id}
Content-Type: application/json

{
  "id": "marketing",
  "name": "Marketing Team",
  "description": "Updated description"
}

Delete Space

DELETE /kibana/api/spaces/space/{id}

Alerting

Find Alert Rules

GET /kibana/api/alerting/rules/_find

Query Parameters:

• search - Search query
• page - Page number
• per_page - Results per page

Response:

{
  "page": 1,
  "per_page": 10,
  "total": 5,
  "data": [
    {
      "id": "abc123",
      "name": "CPU Alert",
      "consumer": "alerts",
      "enabled": true,
      "rule_type_id": "metrics.alert.threshold"
    }
  ]
}

Get Alert Rule

GET /kibana/api/alerting/rule/{id}

Enable/Disable Rule

POST /kibana/api/alerting/rule/{id}/_enable
POST /kibana/api/alerting/rule/{id}/_disable

Mute/Unmute Rule

POST /kibana/api/alerting/rule/{id}/_mute_all
POST /kibana/api/alerting/rule/{id}/_unmute_all

Get Alerting Health

GET /kibana/api/alerting/_health

Connectors (Actions)

List Connectors

GET /kibana/api/actions/connectors

Response:

[
  {
    "id": "abc123",
    "name": "Email Connector",
    "connector_type_id": ".email",
    "is_preconfigured": false,
    "is_deprecated": false
  }
]

Get Connector

GET /kibana/api/actions/connector/{id}

List Connector Types

GET /kibana/api/actions/connector_types

Execute Connector

POST /kibana/api/actions/connector/{id}/_execute
Content-Type: application/json

{
  "params": {
    "to": ["[email protected]"],
    "subject": "Alert",
    "message": "Alert triggered"
  }
}

Fleet

List Agent Policies

GET /kibana/api/fleet/agent_policies

Response:

{
  "items": [
    {
      "id": "abc123",
      "name": "Default policy",
      "namespace": "default",
      "status": "active"
    }
  ],
  "total": 1,
  "page": 1,
  "perPage": 20
}

List Agents

GET /kibana/api/fleet/agents

List Packages

GET /kibana/api/fleet/epm/packages

Returns all available integrations/packages.

Security

List Roles

GET /kibana/api/security/role

Response:

[
  {
    "name": "admin",
    "metadata": {},
    "elasticsearch": {
      "cluster": ["all"],
      "indices": [...]
    },
    "kibana": [...]
  }
]

Get Role

GET /kibana/api/security/role/{name}

Cases

Find Cases

GET /kibana/api/cases/_find

Query Parameters:

• status - open, in-progress, closed
• severity - low, medium, high, critical
• page - Page number
• perPage - Results per page

Response:

{
  "cases": [],
  "page": 1,
  "per_page": 20,
  "total": 0
}

Code Examples

JavaScript

const response = await fetch('https://gateway.maton.ai/kibana/api/saved_objects/_find?type=dashboard', {
  headers: {
    'Authorization': `Bearer ${process.env.MATON_API_KEY}`,
    'kbn-xsrf': 'true'
  }
});
const dashboards = await response.json();
console.log(dashboards);

Python

import os
import requests

response = requests.get(
    'https://gateway.maton.ai/kibana/api/saved_objects/_find?type=dashboard',
    headers={
        'Authorization': f'Bearer {os.environ["MATON_API_KEY"]}',
        'kbn-xsrf': 'true'
    }
)
print(response.json())

Notes

• All requests require kbn-xsrf: true header
• Saved object types: dashboard, visualization, index-pattern, search, lens, map
• Data views are the modern replacement for index patterns
• Spaces provide multi-tenancy support
• Fleet manages Elastic Agents and integrations
• Some operations require specific Kibana privileges

Error Handling

Resources

• Kibana REST API Documentation
• Saved Objects API
• Alerting API
• Fleet API
• Maton Community
• Maton Support