Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Lists API

Import value list items

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_import</span></div>

Refer to Spaces for more information.

Import value list items from a TXT or CSV file. The maximum file size is 9 million bytes.

You can import items to a new or existing list.

post/api/lists/items/_import

Query parameters

list_idstring nonempty

Value list's identifier.

Example:21b01cfb-058d-44b9-838c-282be16c91cd

List's id.

Required when importing to an existing list.

type'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text'

Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:

  • keyword: Many ECS fields are Elasticsearch keywords
  • ip: IP addresses
  • ip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)

Type of the importing list.

Required when importing a new list whose list id is not specified.

refresh'true' | 'false' | 'wait_for'

Determines when changes made by the request are made visible to search.

Response

Successful response

_versionstring

The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.

@timestampstring date-time
created_atstring date-time required

Autogenerated date of object creation.

created_bystring required

Autogenerated value - user that created object.

descriptionstring nonempty required

Describes the value list.

idstring nonempty required

Value list's identifier.

immutableboolean required
metaSecurityListsAPIListMetadata

Placeholder for metadata about the value list.

namestring nonempty required

Value list's name.

tie_breaker_idstring required

Field used in search to ensure all containers are sorted and returned correctly.

type'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text' required

Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:

  • keyword: Many ECS fields are Elasticsearch keywords
  • ip: IP addresses
  • ip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)
updated_atstring date-time required

Autogenerated date of last object update.

updated_bystring required

Autogenerated value - user that last updated object.

versioninteger required

The document version number.

Example response

{
  "_version": "WzIsMV0=",
  "@timestamp": "2025-01-08T04:47:34.273Z",
  "created_at": "2025-01-08T04:47:34.273Z",
  "created_by": "elastic",
  "id": "21b01cfb-058d-44b9-838c-282be16c91cd",
  "name": "List of bad IPs",
  "tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899",
  "updated_at": "2025-01-08T04:47:34.273Z",
  "updated_by": "elastic",
  "version": 1
}