Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Lists API

Create a value list item

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

Refer to Spaces for more information.

Create a value list item and associate it with the specified value list.

All value list items in the same list must be the same type. For example, each list item in an ip list must define a specific IP address.

info Before creating a list item, you must create a list.

post/api/lists/items

Request body

idstring nonempty

Value list item's identifier.

list_idstring nonempty required

Value list's identifier.

metaSecurityListsAPIListItemMetadata

Placeholder for metadata about the value list item.

refresh'true' | 'false' | 'wait_for'

Determines when changes made by the request are made visible to search.

valuestring nonempty required

The value used to evaluate exceptions.

Example request

{
  "id": "54b01cfb-058d-44b9-838c-282be16c91cd",
  "list_id": "21b01cfb-058d-44b9-838c-282be16c91cd",
  "refresh": "wait_for"
}

Response

Successful response

_versionstring

The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.

@timestampstring date-time
created_atstring date-time required

Autogenerated date of object creation.

created_bystring required

Autogenerated value - user that created object.

idstring nonempty required

Value list item's identifier.

list_idstring nonempty required

Value list's identifier.

metaSecurityListsAPIListItemMetadata

Placeholder for metadata about the value list item.

tie_breaker_idstring required

Field used in search to ensure all containers are sorted and returned correctly.

type'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text' required

Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:

  • keyword: Many ECS fields are Elasticsearch keywords
  • ip: IP addresses
  • ip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)
updated_atstring date-time required

Autogenerated date of last object update.

updated_bystring required

Autogenerated value - user that last updated object.

valuestring nonempty required

The value used to evaluate exceptions.

Example response

{
  "_version": "WzIsMV0=",
  "@timestamp": "2025-01-08T04:47:34.273Z",
  "created_at": "2025-01-08T04:47:34.273Z",
  "created_by": "elastic",
  "id": "54b01cfb-058d-44b9-838c-282be16c91cd",
  "list_id": "21b01cfb-058d-44b9-838c-282be16c91cd",
  "tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899",
  "updated_at": "2025-01-08T04:47:34.273Z",
  "updated_by": "elastic"
}