---
title: "Update a pack"
method: PUT
path: "/api/osquery/packs/{id}"
tags: ["Security Osquery API"]
---

# Update a pack

`PUT /api/osquery/packs/{id}`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Update a query pack using the pack ID.
> info
> You cannot update a prebuilt pack.

## Path parameters

- `id` string, required — The ID of the pack.

## Request body

- SecurityOsqueryAPIUpdatePacksRequestBody
  - `description` string — The pack description.
  - `enabled` boolean — Enables the pack.
  - `interval` integer — Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.
  - `name` string — The pack name.
  - `policy_ids` string[] — A list of agents policy IDs.
  - `queries` SecurityOsqueryAPIObjectQueries — An object of queries.
  - `rrule_schedule` SecurityOsqueryAPIRRuleScheduleConfig — RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor.
    - `end_date` string, date-time — Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
    - `rrule` string, required — Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim).
    - `splay` string — Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
    - `start_date` string, date-time, required — RFC 3339 datetime string for the schedule's start.
    - `timeout` number — Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
  - `schedule_type` 'interval' | 'rrule' — Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
  - `shards` SecurityOsqueryAPIShards — An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPIUpdatePacksResponse — The response for updating a pack.
  - `data` object
    - `created_at` string, date-time
    - `created_by` string, nullable
    - `created_by_profile_uid` string
    - `description` string — The pack description.
    - `enabled` boolean — Enables the pack.
    - `interval` integer — Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.
    - `name` string — The pack name.
    - `policy_ids` string[] — A list of agents policy IDs.
    - `queries` SecurityOsqueryAPIObjectQueries — An object of queries.
    - `rrule_schedule` SecurityOsqueryAPIRRuleScheduleConfig — RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor.
      - `end_date` string, date-time — Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
      - `rrule` string, required — Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim).
      - `splay` string — Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
      - `start_date` string, date-time, required — RFC 3339 datetime string for the schedule's start.
      - `timeout` number — Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
    - `saved_object_id` string — The saved object ID of the pack.
    - `schedule_type` 'interval' | 'rrule' — Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
    - `shards` SecurityOsqueryAPIShards — An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
    - `updated_at` string, date-time
    - `updated_by` string, nullable
    - `updated_by_profile_uid` string
    - `version` integer — The pack version number.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)