---
title: "Run a connector"
method: POST
path: "/api/actions/connector/{id}/_execute"
tags: ["connectors"]
---

# Run a connector

`POST /api/actions/connector/{id}/_execute`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}/_execute</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.

## Path parameters

- `id` string, required

## Headers

- `kbn-xsrf` string, required

## Request body

- KibanaHTTPAPIsConnectorExecuteRequest
  - `params` union, required
    - object — Test an action that acknowledges or resolves a PagerDuty alert.
      - `dedupKey` string, required — The deduplication key for the PagerDuty alert.
      - `eventAction` 'acknowledge' | 'resolve', required — The type of event.
    - object — Test an action that indexes a document into Elasticsearch.
      - `documents` object[], required — The documents in JSON format for index connectors.
    - object — Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.
      - `bcc` string[] — A list of "blind carbon copy" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format
      - `cc` string[] — A list of "carbon copy" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format
      - `message` string, required — The email message text. Markdown format is supported.
      - `subject` string, required — The subject line of the email.
      - `to` string[] — A list of email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
    - object — Test an action that writes an entry to the Kibana server log.
      - `level` 'debug' | 'error' | 'fatal' | 'info' | 'trace' | 'warn' — The log level of the message for server log connectors.
      - `message` string, required — The message for server log connectors.
    - object — Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.
      - `message` string, required — The Slack message text, which cannot contain Markdown, images, or other advanced formatting.
    - object — Test an action that triggers a PagerDuty alert.
      - `class` string — The class or type of the event.
      - `component` string — The component of the source machine that is responsible for the event.
      - `customDetails` object — Additional details to add to the event.
      - `dedupKey` string — All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.
      - `eventAction` 'trigger', required — The type of event.
      - `group` string — The logical grouping of components of a service.
      - `links` object[] — A list of links to add to the event.
        - `href` string — The URL for the link.
        - `text` string — A plain text description of the purpose of the link.
      - `severity` 'critical' | 'error' | 'info' | 'warning' — The severity of the event on the affected system.
      - `source` string — The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.
      - `summary` string — A summery of the event.
      - `timestamp` string, date-time — An ISO-8601 timestamp that indicates when the event was detected or generated.
    - object — The `addEvent` subaction for ServiceNow ITOM connectors.
      - `subAction` 'addEvent', required — The action to test.
      - `subActionParams` object — The set of configuration properties for the action.
        - `additional_info` string — Additional information about the event.
        - `description` string — The details about the event.
        - `event_class` string — A specific instance of the source.
        - `message_key` string — All actions sharing this key are associated with the same ServiceNow alert. The default value is `<rule ID>:<alert instance ID>`.
        - `metric_name` string — The name of the metric.
        - `node` string — The host that the event was triggered for.
        - `resource` string — The name of the resource.
        - `severity` string — The severity of the event.
        - `source` string — The name of the event source type.
        - `time_of_event` string — The time of the event.
        - `type` string — The type of event.
    - object — The `closeAlert` subaction for Opsgenie connectors.
      - `subAction` 'closeAlert', required — The action to test.
      - `subActionParams` object, required
        - `alias` string, required — The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
        - `note` string — Additional information for the alert.
        - `source` string — The display name for the source of the alert.
        - `user` string — The display name for the owner.
    - object — The `closeIncident` subaction for ServiceNow ITSM connectors.
      - `subAction` 'closeIncident', required — The action to test.
      - `subActionParams` object, required
        - `incident` union, required
          - object
            - `correlation_id` string, nullable, required — An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
            - `externalId` string, nullable — The unique identifier (`incidentId`) for the incident in ServiceNow.
          - object
            - `correlation_id` string, nullable — An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
            - `externalId` string, nullable, required — The unique identifier (`incidentId`) for the incident in ServiceNow.
    - object — The `createAlert` subaction for Opsgenie and TheHive connectors.
      - `subAction` 'createAlert', required — The action to test.
      - `subActionParams` object, required
        - `actions` string[] — The custom actions available to the alert in Opsgenie connectors.
        - `alias` string — The unique identifier used for alert deduplication in Opsgenie.
        - `description` string — A description that provides detailed information about the alert.
        - `details` object — The custom properties of the alert in Opsgenie connectors.
        - `entity` string — The domain of the alert in Opsgenie connectors. For example, the application or server name.
        - `message` string — The alert message in Opsgenie connectors.
        - `note` string — Additional information for the alert in Opsgenie connectors.
        - `priority` 'P1' | 'P2' | 'P3' | 'P4' | 'P5' — The priority level for the alert in Opsgenie connectors.
        - `responders` object[] — The entities to receive notifications about the alert in Opsgenie connectors. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.
          - `id` string — The identifier for the entity.
          - `name` string — The name of the entity.
          - `type` 'escalation' | 'schedule' | 'team' | 'user' — The type of responders, in this case `escalation`.
          - `username` string — A valid email address for the user.
        - `severity` integer — The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
        - `source` string — The display name for the source of the alert in Opsgenie and TheHive connectors.
        - `sourceRef` string — A source reference for the alert in TheHive connectors.
        - `tags` string[] — The tags for the alert in Opsgenie and TheHive connectors.
        - `title` string — A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.
        - `tlp` integer — The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
        - `type` string — The type of alert in TheHive connectors.
        - `user` string — The display name for the owner.
        - `visibleTo` object[] — The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.
          - `id` string — The identifier for the entity.
          - `name` string — The name of the entity.
          - `type` 'team' | 'user', required — Valid values are `team` and `user`.
          - `username` string — The user name. This property is required only when the `type` is `user`.
    - object — The `fieldsByIssueType` subaction for Jira connectors.
      - `subAction` 'fieldsByIssueType', required — The action to test.
      - `subActionParams` object, required
        - `id` string, required — The Jira issue type identifier.
    - object — The `getAgentDetails` subaction for CrowdStrike connectors.
      - `subAction` 'getAgentDetails', required — The action to test.
      - `subActionParams` object, required — The set of configuration properties for the action.
        - `ids` string[], required — An array of CrowdStrike agent identifiers.
    - object — The `getAgents` subaction for SentinelOne connectors.
      - `subAction` 'getAgents', required — The action to test.
    - object — The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
      - `subAction` 'getChoices', required — The action to test.
      - `subActionParams` object, required — The set of configuration properties for the action.
        - `fields` string[], required — An array of fields.
    - object — The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
      - `subAction` 'getFields', required — The action to test.
    - object — The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
      - `subAction` 'getIncident', required — The action to test.
      - `subActionParams` object, required
        - `externalId` string, required — The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
    - object — The `issue` subaction for Jira connectors.
      - `subAction` 'issue', required — The action to test.
      - `subActionParams` object
        - `id` string, required — The Jira issue identifier.
    - object — The `issues` subaction for Jira connectors.
      - `subAction` 'issues', required — The action to test.
      - `subActionParams` object, required
        - `title` string, required — The title of the Jira issue.
    - object — The `issueTypes` subaction for Jira connectors.
      - `subAction` 'issueTypes', required — The action to test.
    - object — Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack_api`.
      - `subAction` 'postMessage', required — The action to test.
      - `subActionParams` object, required — The set of configuration properties for the action.
        - `channelIds` string[] — The Slack channel identifier, which must be one of the `allowedChannels` in the connector configuration.
        - `channels` string[] — The name of a channel that your Slack app has access to.
        - `text` string — The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.
    - object — The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
      - `subAction` 'pushToService', required — The action to test.
      - `subActionParams` object, required — The set of configuration properties for the action.
        - `comments` object[] — Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.
          - `comment` string — A comment related to the incident. For example, describe how to troubleshoot the issue.
          - `commentId` integer — A unique identifier for the comment.
        - `incident` object — Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.
          - `additional_fields` string, nullable — Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
          - `alertId` string — The alert identifier for Swimlane connectors.
          - `caseId` string — The case identifier for the incident for Swimlane connectors.
          - `caseName` string — The case name for the incident for Swimlane connectors.
          - `category` string — The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `correlation_display` string — A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `correlation_id` string — The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
          - `description` string — The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
          - `dest_ip` union — A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
            - string
            - string[]
          - `externalId` string — The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
          - `id` string — The external case identifier for Webhook - Case Management connectors.
          - `impact` string — The impact of the incident for ServiceNow ITSM connectors.
          - `issueType` integer — The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`.
          - `labels` string[] — The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
          - `malware_hash` union — A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
            - string
            - string[]
          - `malware_url` string — A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
          - `otherFields` object — Custom field identifiers and their values for Jira connectors.
          - `parent` string — The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues.
          - `priority` string — The priority of the incident in Jira and ServiceNow SecOps connectors.
          - `ruleName` string — The rule name for Swimlane connectors.
          - `severity` integer — The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
          - `short_description` string — A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
          - `source_ip` union — A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
            - string
            - string[]
          - `status` string — The status of the incident for Webhook - Case Management connectors.
          - `subcategory` string — The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `summary` string — A summary of the incident for Jira connectors.
          - `tags` string[] — A list of tags for TheHive and Webhook - Case Management connectors.
          - `title` string — A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.
          - `tlp` integer — The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
          - `urgency` string — The urgency of the incident for ServiceNow ITSM connectors.
    - object — Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is `.slack_api`.
      - `subAction` 'validChannelId', required — The action to test.
      - `subActionParams` object, required
        - `channelId` string, required — The Slack channel identifier.

## Response `200`

Indicates a successful call.

- KibanaHTTPAPIsConnectorResponse
  - `auth_mode` 'shared' | 'per-user' — The authentication mode used for the connector.
  - `config` object
  - `connector_type_id` string, required — The connector type identifier.
  - `id` string, required — The identifier for the connector.
  - `is_connector_type_deprecated` boolean, required — Indicates whether the connector type is deprecated.
  - `is_deprecated` boolean, required — Indicates whether the connector is deprecated.
  - `is_missing_secrets` boolean — Indicates whether the connector is missing secrets.
  - `is_preconfigured` boolean, required — Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response.
  - `is_system_action` boolean, required — Indicates whether the connector is used for system actions.
  - `name` string, required — The name of the connector.

## Other responses

- `403` — Indicates that this call is forbidden.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)