--- title: "Update a connector" method: PUT path: "/api/actions/connector/{id}" tags: ["connectors"] --- # Update a connector `PUT /api/actions/connector/{id}` **Spaces method and path for this operation:**
put /s/{space_id}/api/actions/connector/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. ## Path parameters - `id` string, required ## Headers - `kbn-xsrf` string, required ## Request body - KibanaHTTPAPIsUpdateConnector - `name` string, required — The display name for the connector. - `config` union — The connector configuration details. - object — Defines properties for connectors when type is `.bedrock`. - `apiUrl` string, required — The Amazon Bedrock request URL. - `region` string — Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`). - `defaultModel` string — The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models. - object — Defines config properties for connectors when type is `.crowdstrike`. - `url` string, required — The CrowdStrike tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines properties for connectors when type is `.d3security`. - `url` string, required — The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines properties for connectors when type is `.email`. - `allowHtml` boolean — When `true`, the connector can send emails with HTML-formatted content in the body. Defaults to `false`. This option is unavailable when `service` is `elastic_cloud`. - `clientId` string, nullable — The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required. - `from` string, required — The from address for all emails sent by the connector. It must be specified in `user@host-name` format. - `hasAuth` boolean — Specifies whether a user and password are required inside the secrets configuration. - `host` string — The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. - `oauthTokenUrl` string, nullable - `port` integer — The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. - `secure` boolean — Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. - `service` 'elastic_cloud' | 'exchange_server' | 'gmail' | 'other' | 'outlook365' | 'ses' — The name of the email service. - `tenantId` string, nullable — The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required. - object — Defines properties for connectors when type is `.gemini`. - `apiUrl` string, required — The Google Gemini request URL. - `defaultModel` string — The generative artificial intelligence model for Google Gemini to use. - `gcpRegion` string, required — The GCP region where the Vertex AI endpoint enabled. - `gcpProjectID` string, required — The Google ProjectID that has Vertex AI endpoint enabled. - object — Defines properties for connectors when type is `.resilient`. - `apiUrl` string, required — The IBM Resilient instance URL. - `orgId` string, required — The IBM Resilient organization ID. - object — Defines properties for connectors when type is `.index`. - `executionTimeField` string, nullable — A field that indicates when the document was indexed. - `index` string, required — The Elasticsearch index to be written to. - `refresh` boolean — The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs. - object — Defines properties for connectors when type is `.jira`. - `apiUrl` string, required — The Jira instance URL. - `projectKey` string, required — The Jira project key. - object — Defines properties for connectors when type is `.microsoft_defender_endpoint`. - `apiUrl` string, required — The URL of the Microsoft Defender for Endpoint API. If you are using the `xpack.actions.allowedHosts` setting, make sure the hostname is added to the allowed hosts. - `clientId` string — The application (client) identifier for your app in the Azure portal. - `oAuthScope` string — The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API. - `oAuthServerUrl` string — The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API. - `tenantId` string — The tenant identifier for your app in the Azure portal. - object — Defines properties for connectors when type is `.gen-ai` and the API provider is `Azure OpenAI`. - `apiProvider` 'Azure OpenAI', required — The OpenAI API provider. - `apiUrl` string, required — The OpenAI API endpoint. - object — Defines properties for connectors when type is `.gen-ai` and the API provider is `OpenAI`. - `apiProvider` 'OpenAI', required — The OpenAI API provider. - `apiUrl` string, required — The OpenAI API endpoint. - `defaultModel` string — The default model to use for requests. - object — Defines properties for connectors when type is `.opsgenie`. - `apiUrl` string, required — The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines properties for connectors when type is `.pagerduty`. - `apiUrl` string, nullable — The PagerDuty event URL. - object — Defines properties for connectors when type is `.sentinelone`. - `url` string, required — The SentinelOne tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines properties for connectors when type is `.servicenow`. - `apiUrl` string, required — The ServiceNow instance URL. - `clientId` string — The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`. - `isOAuth` boolean — The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth). - `jwtKeyId` string — The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`. - `userIdentifierValue` string — The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`. - `usesTableApi` boolean — Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow. - object — Defines properties for connectors when type is `.servicenow-itom`. - `apiUrl` string, required — The ServiceNow instance URL. - `clientId` string — The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`. - `isOAuth` boolean — The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth). - `jwtKeyId` string — The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`. - `userIdentifierValue` string — The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`. - object — Defines properties for connectors when type is `.slack_api`. - `allowedChannels` object[] — A list of valid Slack channels. - `id` string, required — The Slack channel ID. - `name` string, required — The Slack channel name. - object — Defines properties for connectors when type is `.swimlane`. - `apiUrl` string, required — The Swimlane instance URL. - `appId` string, required — The Swimlane application ID. - `connectorType` 'all' | 'alerts' | 'cases', required — The type of connector. Valid values are `all`, `alerts`, and `cases`. - `mappings` object — The field mapping. - `alertIdConfig` object — Mapping for the alert ID. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `caseIdConfig` object — Mapping for the case ID. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `caseNameConfig` object — Mapping for the case name. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `commentsConfig` object — Mapping for the case comments. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `descriptionConfig` object — Mapping for the case description. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `ruleNameConfig` object — Mapping for the name of the alert's rule. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - `severityConfig` object — Mapping for the severity. - `fieldType` string, required — The type of field in Swimlane. - `id` string, required — The identifier for the field in Swimlane. - `key` string, required — The key for the field in Swimlane. - `name` string, required — The name of the field in Swimlane. - object — Defines configuration properties for connectors when type is `.thehive`. - `organisation` string — The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key. - `url` string, required — The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines properties for connectors when type is `.tines`. - `url` string, required — The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts. - object — Defines properties for connectors when type is `.torq`. - `webhookIntegrationUrl` string, required — The endpoint URL of the Elastic Security integration in Torq. - object — Defines properties for connectors when type is `.webhook`. - `accessTokenUrl` string — The URL used to request an OAuth2 access token. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required. - `additionalFields` string, nullable — Additional fields, encoded as a JSON object, sent as part of the OAuth2 access token request body. - `authType` 'webhook-authentication-basic' | 'webhook-authentication-ssl' | 'webhook-oauth2-client-credentials', nullable — The type of authentication to use: basic, SSL, OAuth2 client credentials, or none. - `ca` string — A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types. - `certType` 'ssl-crt-key' | 'ssl-pfx' — If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format. - `clientId` string — The client identifier for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required. - `hasAuth` boolean — If true, a username and password for login type authentication must be provided. - `headers` object, nullable — A set of key-value pairs sent as headers with the request. - `method` 'post' | 'put' | 'patch' | 'get' | 'delete' — The HTTP request method: `post`, `put`, `patch`, `get`, or `delete`. - `scope` string — The scope requested when acquiring the OAuth2 access token. - `url` string — The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - `verificationMode` 'certificate' | 'full' | 'none' — Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation. - object — Defines properties for connectors when type is `.cases-webhook`. - `authType` 'webhook-authentication-basic' | 'webhook-authentication-ssl' | 'webhook-oauth2-client-credentials', nullable — The type of authentication to use: basic, SSL, OAuth2 client credentials, or none. - `ca` string — A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types. - `certType` 'ssl-crt-key' | 'ssl-pfx' — If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format. - `createCommentJson` string — A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. - `createCommentMethod` 'patch' | 'post' | 'put' — The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`. - `createCommentUrl` string — The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts. - `createIncidentJson` string, required — A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. - `createIncidentMethod` 'patch' | 'post' | 'put' — The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`. - `createIncidentResponseKey` string, required — The JSON key in the create external case response that contains the case ID. - `createIncidentUrl` string, required — The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - `getIncidentResponseExternalTitleKey` string, required — The JSON key in get external case response that contains the case title. - `getIncidentUrl` string, required — The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. - `hasAuth` boolean — If true, a username and password for login type authentication must be provided. - `headers` object, nullable — A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods. - `updateIncidentJson` string, required — The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. - `updateIncidentMethod` 'patch' | 'post' | 'put' — The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`. - `updateIncidentUrl` string, required — The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - `verificationMode` 'certificate' | 'full' | 'none' — Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation. - `viewIncidentUrl` string, required — The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL. - object — Defines properties for connectors when type is `.xmatters`. - `configUrl` string, nullable — The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`. - `usesBasic` boolean — Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`). - `secrets` union - object — Defines secrets for connectors when type is `.bedrock`. - `accessKey` string, required — The AWS access key for authentication. - `secret` string, required — The AWS secret for authentication. - object — Defines secrets for connectors when type is `.crowdstrike`. - `clientId` string, required — The CrowdStrike API client identifier. - `clientSecret` string, required — The CrowdStrike API client secret to authenticate the `clientId`. - object — Defines secrets for connectors when type is `.d3security`. - `token` string, required — The D3 Security token. - object — Defines secrets for connectors when type is `.email`. - `clientSecret` string — The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required. - `password` string — The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required. - `user` string — The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required. - object — Defines secrets for connectors when type is `.gemini`. - `credentialsJson` string, required — The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it. - object — Defines secrets for connectors when type is `.resilient`. - `apiKeyId` string, required — The authentication key ID for HTTP Basic authentication. - `apiKeySecret` string, required — The authentication key secret for HTTP Basic authentication. - object — Defines secrets for connectors when type is `.jira`. - `apiToken` string, required — The Jira API authentication token for HTTP basic authentication. - `email` string, required — The account email for HTTP Basic authentication. - object — Defines secrets for connectors when type is `.teams`. - `webhookUrl` string, required — The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. - object — Defines secrets for connectors when type is `.gen-ai`. Supports both API key authentication (OpenAI, Azure OpenAI, and `Other`) and PKI authentication (`Other` provider only). PKI fields must be base64-encoded PEM content. - `apiKey` string — The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the `Other` provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one. - `certificateData` string — Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI. - `privateKeyData` string — Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI. - `caData` string — Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional. - object — Defines secrets for connectors when type is `.opsgenie`. - `apiKey` string, required — The Opsgenie API authentication key for HTTP Basic authentication. - object — Defines secrets for connectors when type is `.pagerduty`. - `routingKey` string, required — A 32 character PagerDuty Integration Key for an integration on a service. - object — Defines secrets for connectors when type is `.sentinelone`. - `token` string, required — The A SentinelOne API token. - object — Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`. - `clientSecret` string — The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`. - `password` string — The password for HTTP basic authentication. This property is required when `isOAuth` is `false`. - `privateKey` string — The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`. - `privateKeyPassword` string — The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key. - `username` string — The username for HTTP basic authentication. This property is required when `isOAuth` is `false`. - object — Defines secrets for connectors when type is `.slack`. - `token` string, required — Slack bot user OAuth token. - object — Defines secrets for connectors when type is `.swimlane`. - `apiToken` string — Swimlane API authentication token. - object — Defines secrets for connectors when type is `.thehive`. - `apiKey` string, required — The API key for authentication in TheHive. - object — Defines secrets for connectors when type is `.tines`. - `email` string, required — The email used to sign in to Tines. - `token` string, required — The Tines API token. - object — Defines secrets for connectors when type is `.torq`. - `token` string, required — The secret of the webhook authentication header. - object — Defines secrets for connectors when type is `.webhook`. - `clientSecret` string — The client secret for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required. - `crt` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file. - `key` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file. - `pfx` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file. - `password` string — The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required. - `user` string — The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required. - object - `crt` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file. - `key` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file. - `pfx` string — If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file. - `password` string — The password for HTTP basic authentication. If `hasAuth` is set to `true` and and `authType` is `webhook-authentication-basic`, this property is required. - `user` string — The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required. - object — Defines secrets for connectors when type is `.xmatters`. - `password` string — A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`. - `secretsUrl` string — The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`. - `user` string — A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`. ## Response `200` Indicates a successful call. - KibanaHTTPAPIsConnectorResponse - `auth_mode` 'shared' | 'per-user' — The authentication mode used for the connector. - `config` object - `connector_type_id` string, required — The connector type identifier. - `id` string, required — The identifier for the connector. - `is_connector_type_deprecated` boolean, required — Indicates whether the connector type is deprecated. - `is_deprecated` boolean, required — Indicates whether the connector is deprecated. - `is_missing_secrets` boolean — Indicates whether the connector is missing secrets. - `is_preconfigured` boolean, required — Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. - `is_system_action` boolean, required — Indicates whether the connector is used for system actions. - `name` string, required — The name of the connector. ## Other responses - `403` — Indicates that this call is forbidden. --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)