---
title: "Initialize security solution flows"
method: POST
path: "/api/security_solution/initialize"
tags: ["Security Solution Initialization API"]
---

# Initialize security solution flows

`POST /api/security_solution/initialize`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_solution/initialize</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Run one or more Security Solution initialization flows for the current space.
Each flow provisions a specific set of assets, for example list indices,
security data views, prebuilt detection rules, endpoint protection, AI prompts,
or detection rule monitoring assets. Only the requested flows are run, and the
response reports a result for each one.

## Request body

- object
  - `flows` SecuritySolutionInitializationAPIInitializationFlowId[], required

## Response `200`

Indicates a successful call. Returns a result for each requested flow.

- object
  - `flows` SecuritySolutionInitializationAPIInitializationFlowsResult, required — Per-flow results. Only requested flows appear in the response, so all properties are optional. Each flow is either a typed ready result or an error result.
    - `create-list-indices` union
      - SecuritySolutionInitializationAPICreateListIndicesReadyResult
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required
    - `init-ai-prompts` union
      - SecuritySolutionInitializationAPIPackageInstallReadyResult
        - `payload` object, required
          - `install_status` string, required — Fleet package installation status (e.g., installed, already_installed).
          - `name` string, required
          - `version` string, required
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required
    - `init-detection-rule-monitoring` union
      - SecuritySolutionInitializationAPIInstallDetectionEngineRuleMonitoringAssetsReadyResult
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required
    - `init-endpoint-protection` union
      - SecuritySolutionInitializationAPIPackageInstallReadyResult
        - `payload` object, required
          - `install_status` string, required — Fleet package installation status (e.g., installed, already_installed).
          - `name` string, required
          - `version` string, required
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required
    - `init-prebuilt-rules` union
      - SecuritySolutionInitializationAPIPackageInstallReadyResult
        - `payload` object, required
          - `install_status` string, required — Fleet package installation status (e.g., installed, already_installed).
          - `name` string, required
          - `version` string, required
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required
    - `security-data-views` union
      - SecuritySolutionInitializationAPISecurityDataViewsReadyResult
        - `payload` object, required
          - `alertDataView` SecuritySolutionInitializationAPIDataViewPayload, required
            - `id` string, required
            - `patternList` string[], required
            - `title` string, required
          - `attackDataView` SecuritySolutionInitializationAPIDataViewPayload
            - `id` string, required
            - `patternList` string[], required
            - `title` string, required
          - `defaultDataView` SecuritySolutionInitializationAPIDataViewPayload, required
            - `id` string, required
            - `patternList` string[], required
            - `title` string, required
          - `kibanaDataViews` SecuritySolutionInitializationAPIDataViewPayload[], required
            - `id` string, required
            - `patternList` string[], required
            - `title` string, required
          - `signalIndexName` string, required
        - `status` 'ready', required
      - SecuritySolutionInitializationAPIInitializationFlowErrorResult
        - `error` string, nullable, required
        - `status` 'error', required

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)