# API coverage
Generated by `tools/api_coverage.py`. Do not edit by hand.
Baseline: the [Kibana 9.5.4 OpenAPI bundle](https://raw.githubusercontent.com/elastic/kibana/v9.5.4/oas_docs/output/kibana.yaml) (SHA-256 `a5dd0f2a0fa30f2bdcba6b42c712b9bfcd89f22aef29c9bf5285328f014279d9`).
78 of 663 published operations have a named builder (11.8%). This measures endpoint breadth, not contract completeness.
| Detection engine | 30 | 9 | 21 |
| Exceptions | 14 | 14 | 0 |
| Cases | 29 | 7 | 22 |
| Fleet | 156 | 38 | 118 |
| Spaces | 10 | 5 | 5 |
| Roles | 6 | 4 | 2 |
| Status | 1 | 1 | 0 |
| Other APIs | 417 | 0 | 417 |
| **Total** | **663** | **78** | **585** |
- Every named builder has an offline test asserting its method, path, query and body.
- **Live** is `success` or `rejection` when a linked scenario's outcome has been reviewed; `called` records call presence only. These labels describe tests, not a fresh passing run.
- **Contract** is `partial` when a known request or response option is not modeled and `unreviewed` when the full contract has not been audited.
- The [supported workflow review](supported-contracts.md) records the checked subsets, version differences and limits. The separate [schema drift check](schema-drift.md) compares pinned contracts and validates retained fixtures.
- The published total includes 40 deprecated operations and some internal or placeholder routes.
| `cases.add_comment` | `addCaseCommentDefaultSpace` | `POST /api/cases/{caseId}/comments` | partial | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Typed free-text comments; alert and other attachments only as caller-supplied JSON. Returns the updated case. |
| `cases.create` | `createCaseDefaultSpace` | `POST /api/cases` | partial | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Typed severity, tags, connector and syncAlerts; assignees, category and custom fields only as caller-supplied JSON. |
| `cases.delete` | `deleteCaseDefaultSpace` | `DELETE /api/cases` | unreviewed | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | ID-list deletion; no full contract audit. |
| `cases.find` | `findCasesDefaultSpace` | `GET /api/cases/_find` | partial | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Page, page size, owners, search, status, severity, tags and sorting; no assignee, reporter, category or date-range filters. |
| `cases.find_comments` | `findCaseCommentsDefaultSpace` | `GET /api/cases/{caseId}/comments/_find` | partial | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Page, page size and sort order; comments remain JSON. |
| `cases.get` | `getCaseDefaultSpace` | `GET /api/cases/{caseId}` | unreviewed | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Core case fields and extensible JSON response. |
| `cases.update` | `updateCaseDefaultSpace` | `PATCH /api/cases` | partial | [success](../tests/live.rs "security_cases_comments_and_version_conflicts") | Versioned updates with typed common fields and CasePatch::field for extra settings; id and version cannot be replaced by extra fields. |
| `client.status` | `get-status` | `GET /api/status` | unreviewed | called | JSON status response; completeness not audited. |
| `exceptions.create_item` | `CreateExceptionListItem` | `POST /api/exception_lists/items` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Typed match, match_any, exists, wildcard, value-list reference and nested entries, plus OS types; Endpoint artifact validation deferred. |
| `exceptions.create_list` | `CreateExceptionList` | `POST /api/exception_lists` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Detection list fields, OS types and user-defined version; Endpoint artifact constraints not validated by the client. |
| `exceptions.delete_item` | `DeleteExceptionListItem` | `DELETE /api/exception_lists/items` | unreviewed | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Core fields and extensible response; full contract parity not audited. |
| `exceptions.delete_list` | `DeleteExceptionList` | `DELETE /api/exception_lists` | unreviewed | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Core fields and extensible response; full contract parity not audited. |
| `exceptions.duplicate_list` | `DuplicateExceptionList` | `POST /api/exception_lists/_duplicate` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | List ID, namespace and expired-item selection; response retains extra fields. |
| `exceptions.export_list` | `ExportExceptionList` | `POST /api/exception_lists/_export` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Streaming NDJSON with namespace and expired-item selection. Value-list contents excluded. |
| `exceptions.find_items` | `FindExceptionListItems` | `GET /api/exception_lists/items/_find` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | One list per call; pagination, filter, search and sorting, no multi-list option. Upstream scalar parsing does not support literal commas in list IDs/filters. |
| `exceptions.find_lists` | `FindExceptionLists` | `GET /api/exception_lists/_find` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Namespace, explicit pagination, filter and sorting. |
| `exceptions.get_item` | `ReadExceptionListItem` | `GET /api/exception_lists/items` | unreviewed | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Core fields and extensible response; full contract parity not audited. |
| `exceptions.get_list` | `ReadExceptionList` | `GET /api/exception_lists` | unreviewed | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Core fields and extensible response; full contract parity not audited. |
| `exceptions.import_lists` | `ImportExceptionList` | `POST /api/exception_lists/_import` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Multipart NDJSON with overwrite/as_new_list options; preserves HTTP-200 partial failures. Value-list contents excluded. |
| `exceptions.summary` | `ReadExceptionListSummary` | `GET /api/exception_lists/summary` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | JSON OS summary with optional filter. Upstream can report total=0 when no items have os_types; use find_items().total for item counts. |
| `exceptions.update_item` | `UpdateExceptionListItem` | `PUT /api/exception_lists/items` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Explicit optimistic concurrency token; replaces modeled fields. Endpoint artifact validation deferred. |
| `exceptions.update_list` | `UpdateExceptionList` | `PUT /api/exception_lists` | partial | [success](../tests/live.rs "exception_lists_items_roundtrip_conflicts_and_spaces") | Explicit optimistic concurrency token; replaces modeled fields, not a patch. |
| `fleet.agent_action_status` | `get-fleet-agents-action-status` | `GET /api/fleet/agents/action_status` | partial | [success](../tests/deployment.rs "fleet_agent_bulk_actions_and_diagnostics") | Zero-based page, page size, date/latest window and error size. Typed status, counters and extensible fields. Wait helper expands page zero through 10,000 action documents within its deadline. |
| `fleet.agent_status` | `get-fleet-agent-status` | `GET /api/fleet/agent_status` | unreviewed | called | JSON status summary. |
| `fleet.bulk_reassign_agents` | `post-fleet-agents-bulk-reassign` | `POST /api/fleet/agents/bulk_reassign` | unreviewed | called | ID/KQL selection, dryRun, batchSize and includeInactive; typed action or dry-run result. |
| `fleet.bulk_request_agent_diagnostics` | `post-fleet-agents-bulk-request-diagnostics` | `POST /api/fleet/agents/bulk_request_diagnostics` | partial | called | ID/KQL selection, dryRun, batchSize and CPU metric; no includeInactive contract. |
| `fleet.bulk_unenroll_agents` | `post-fleet-agents-bulk-unenroll` | `POST /api/fleet/agents/bulk_unenroll` | unreviewed | called | ID/KQL selection, dryRun, batchSize, includeInactive, force and revoke; typed action or dry-run result. |
| `fleet.bulk_update_agent_tags` | `post-fleet-agents-bulk-update-agent-tags` | `POST /api/fleet/agents/bulk_update_agent_tags` | unreviewed | called | ID/KQL selection, tags to add or remove, dryRun, batchSize and includeInactive; typed action or dry-run result. |
| `fleet.bulk_upgrade_agents` | `post-fleet-agents-bulk-upgrade` | `POST /api/fleet/agents/bulk_upgrade` | partial | - | Typed selection, dry-run and rollout options; acceptance and dry-run count distinguished. |
| `fleet.cancel_agent_action` | `post-fleet-agents-actions-actionid-cancel` | `POST /api/fleet/agents/actions/{actionId}/cancel` | partial | - | JSON response; Kibana cancels upgrade and unenrollment actions only. |
| `fleet.copy_agent_policy` | `post-fleet-agent-policies-agentpolicyid-copy` | `POST /api/fleet/agent_policies/{agentPolicyId}/copy` | partial | called | New name and description. |
| `fleet.create_agent_policy` | `post-fleet-agent-policies` | `POST /api/fleet/agent_policies` | partial | called | Typed name, namespace, description, monitoring, output and inactivity settings plus sys_monitoring; other settings only as caller-supplied JSON. |
| `fleet.create_enrollment_key` | `post-fleet-enrollment-api-keys` | `POST /api/fleet/enrollment_api_keys` | partial | called | Policy, name and expiration; credential redacted in Debug. Selected response fields only. |
| `fleet.create_package_policy` | `post-fleet-package-policies` | `POST /api/fleet/package_policies` | partial | called | Simplified inputs with JSON vars; selected top-level fields only. |
| `fleet.delete_agent_policy` | `post-fleet-agent-policies-delete` | `POST /api/fleet/agent_policies/delete` | unreviewed | called | Policy-ID deletion with optional force; no full contract audit. |
| `fleet.delete_package_policy` | `delete-fleet-package-policies-packagepolicyid` | `DELETE /api/fleet/package_policies/{packagePolicyId}` | unreviewed | called | Single package-policy deletion with optional force, JSON result. |
| `fleet.download_agent_file` | `get-fleet-agents-files-fileid-filename` | `GET /api/fleet/agents/files/{fileId}/{fileName}` | partial | called | Checked streaming binary response, despite the upstream JSON success schema. |
| `fleet.download_agent_policy` | `get-fleet-agent-policies-agentpolicyid-download` | `GET /api/fleet/agent_policies/{agentPolicyId}/download` | unreviewed | called | Checked raw YAML response with standalone and Kubernetes options; download and revision options not exposed. |
| `fleet.find_agent_policies` | `get-fleet-agent-policies` | `GET /api/fleet/agent_policies` | partial | called | Page, page size, KQL and sorting; requests full policies and agent counts by default. No format or upgradeable filters. |
| `fleet.find_agents` | `get-fleet-agents` | `GET /api/fleet/agents` | partial | called | Page, page size, KQL, inactive agents and sorting; no metrics, status summary or point-in-time paging. Historical operation-level evidence used an empty fleet. |
| `fleet.find_enrollment_keys` | `get-fleet-enrollment-api-keys` | `GET /api/fleet/enrollment_api_keys` | partial | called | Explicit pagination and KQL; deprecated duplicate list field omitted. Credentials redacted in Debug. |
| `fleet.find_package_policies` | `get-fleet-package-policies` | `GET /api/fleet/package_policies` | partial | called | Page, page size, KQL and sorting; no format or agent-count options. |
| `fleet.get_agent` | `get-fleet-agents-agentid` | `GET /api/fleet/agents/{agentId}` | unreviewed | [success](../tests/deployment.rs "fleet_agent_bulk_actions_and_diagnostics") | Core fields plus extensible JSON. |
| `fleet.get_agent_policy` | `get-fleet-agent-policies-agentpolicyid` | `GET /api/fleet/agent_policies/{agentPolicyId}` | unreviewed | called | Core policy fields plus extensible JSON. |
| `fleet.get_enrollment_key` | `get-fleet-enrollment-api-keys-keyid` | `GET /api/fleet/enrollment_api_keys/{keyId}` | partial | called | Runtime item envelope; credential is redacted in Debug. Selected fields only. |
| `fleet.get_package` | `get-fleet-epm-packages-pkgname-pkgversion` | `GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}` | unreviewed | called | Exact package name/version; core fields plus extensible JSON. |
| `fleet.get_package_policy` | `get-fleet-package-policies-packagepolicyid` | `GET /api/fleet/package_policies/{packagePolicyId}` | unreviewed | called | Core fields plus extensible JSON; inputs remain JSON. |
| `fleet.install_package` | `post-fleet-epm-packages-pkgname-pkgversion` | `POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}` | partial | called | Force and ignore_constraints options; query options not exposed. JSON asset result. |
| `fleet.list_agent_uploads` | `get-fleet-agents-agentid-uploads` | `GET /api/fleet/agents/{agentId}/uploads` | partial | called | Typed status, action ID and file metadata; Fleet::wait_for_upload polls it until the upload finishes. |
| `fleet.list_outputs` | `get-fleet-outputs` | `GET /api/fleet/outputs` | unreviewed | called | Default output listing as JSON; not output management. |
| `fleet.list_packages` | `get-fleet-epm-packages` | `GET /api/fleet/epm/packages` | partial | called | Category and prerelease filters; other catalogue options not exposed. |
| `fleet.reassign_agent` | `post-fleet-agents-agentid-reassign` | `POST /api/fleet/agents/{agentId}/reassign` | unreviewed | called | Policy-ID reassignment; JSON acknowledgment. |
| `fleet.request_agent_diagnostics` | `post-fleet-agents-agentid-request-diagnostics` | `POST /api/fleet/agents/{agentId}/request_diagnostics` | partial | called | Optional CPU metrics; asynchronous action result, follow upload readiness before download. |
| `fleet.revoke_enrollment_key` | `delete-fleet-enrollment-api-keys-keyid` | `DELETE /api/fleet/enrollment_api_keys/{keyId}` | partial | called | Default revocation only; 9.5-only forceDelete/includeHidden options omitted for 9.4 compatibility. |
| `fleet.setup` | `post-fleet-setup` | `POST /api/fleet/setup` | unreviewed | called | Published in the bundle under Fleet internals; do not infer a stable lifecycle from documentation. |
| `fleet.unenroll_agent` | `post-fleet-agents-agentid-unenroll` | `POST /api/fleet/agents/{agentId}/unenroll` | partial | - | Force and revoke options. |
| `fleet.uninstall_package` | `delete-fleet-epm-packages-pkgname-pkgversion` | `DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}` | unreviewed | called | Optional force; JSON result. |
| `fleet.update_agent_policy` | `put-fleet-agent-policies-agentpolicyid` | `PUT /api/fleet/agent_policies/{agentPolicyId}` | partial | called | Retrieved edits bind the policy ID, retain inactivity timeout and support null output clearing; generic bodies reject a supplied ID that differs from the path. Other settings only as caller-supplied JSON. Selecting an output requires Platinum. No optimistic concurrency check. |
| `fleet.update_package_policy` | `put-fleet-package-policies-packagepolicyid` | `PUT /api/fleet/package_policies/{packagePolicyId}` | partial | called | Simplified input format and selected fields only. |
| `fleet.upgrade_agent` | `post-fleet-agents-agentid-upgrade` | `POST /api/fleet/agents/{agentId}/upgrade` | partial | [rejection](../tests/deployment.rs "fleet_agent_bulk_actions_and_diagnostics") | Typed request; the live scenario verifies container-agent upgrade rejection only. Successful upgrades remain unverified. |
| `roles.delete` | `delete-security-role-name` | `DELETE /api/security/role/{name}` | unreviewed | called | Single global role deletion; no full contract audit. |
| `roles.get` | `get-security-role-name` | `GET /api/security/role/{name}` | partial | called | Kibana privileges, JSON Elasticsearch privileges, description and metadata; read-only fields kept separately. |
| `roles.list` | `get-security-role` | `GET /api/security/role` | partial | called | Kibana privileges, JSON Elasticsearch privileges, description and metadata; read-only fields kept separately. |
| `roles.put` | `put-security-role-name` | `PUT /api/security/role/{name}` | partial | called | Kibana and Elasticsearch privileges, description, metadata and createOnly; other settings only as caller-supplied JSON. |
| `security.create_alerts_index` | `CreateAlertsIndex` | `POST /api/detection_engine/index` | unreviewed | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Alert-index initialization only; not detection execution. |
| `security.create_rule` | `CreateRule` | `POST /api/detection_engine/rules` | partial | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Typed KQL/Lucene query rules with exception-list associations; other rule types only as caller-supplied JSON. |
| `security.delete_rule` | `DeleteRule` | `DELETE /api/detection_engine/rules` | unreviewed | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | ID or rule_id lookup; complete deletion contract not audited. |
| `security.export_rules` | `ExportRules` | `POST /api/detection_engine/rules/_export` | partial | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Optional rule_id selection, exclude_export_details and file_name; raw NDJSON response. |
| `security.find_rules` | `FindRules` | `GET /api/detection_engine/rules/_find` | partial | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Page, page size, filter and sorting; no field selection or gap filters. |
| `security.get_rule` | `ReadRule` | `GET /api/detection_engine/rules` | unreviewed | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | ID or rule_id lookup; response has core fields and an extensible JSON map. |
| `security.import_rules` | `ImportRules` | `POST /api/detection_engine/rules/_import` | partial | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Multipart NDJSON with overwrite, exception, connector and new-list options; typed per-object errors and independent rule, exception and connector outcomes. |
| `security.patch_rule` | `PatchRule` | `PATCH /api/detection_engine/rules` | partial | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | Typed common fields and exception-list replacement; any other field through PatchRule::field. |
| `security.privileges` | `ReadPrivileges` | `GET /api/detection_engine/privileges` | unreviewed | [success](../tests/live.rs "detection_rules_crud_export_import_and_space_isolation") | JSON privilege response. |
| `spaces.create` | `post-spaces-space` | `POST /api/spaces/space` | partial | called | Typed ID, name, description and disabled features; other fields kept in an extensible map. |
| `spaces.delete` | `delete-spaces-space-id` | `DELETE /api/spaces/space/{id}` | unreviewed | called | Single space deletion; no full contract audit. |
| `spaces.get` | `get-spaces-space-id` | `GET /api/spaces/space/{id}` | partial | called | Typed ID, name, description and disabled features; other fields kept in an extensible map. |
| `spaces.list` | `get-spaces-space` | `GET /api/spaces/space` | partial | called | Same space fields as get; no optional listing parameters. |
| `spaces.update` | `put-spaces-space-id` | `PUT /api/spaces/space/{id}` | partial | called | Same fields as creation; the required body ID must match the path before HTTP. Extensible fields are sent back unchanged. |