schema.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "definitions": {

    "action": {
      "title": "Agent action",
      "description": "An Elastic Agent action",
      "type": "object",
      "properties": {
        "_id": {
          "description": "The unique identifier for action document",
          "type": "string"
        },
        "_seq_no": {
          "description": "The action sequence number",
          "type": "integer"
        },
        "action_id": {
          "description": "The unique identifier for the Elastic Agent action. There could be multiple documents with the same action_id if the action is split into two separate documents.",
          "type": "string",
          "format": "uuid"
        },
        "@timestamp": {
          "description": "Date/time the action was created",
          "type": "string",
          "format": "date-time"
        },
        "expiration": {
          "description": "The action expiration date/time",
          "type": "string",
          "format": "date-time"
        },
        "start_time": {
          "description": "The action start date/time",
          "type": "string",
          "format": "date-time"
        },
        "minimum_execution_duration": {
          "description": "The minimum time (in seconds) provided for an action execution when scheduled by fleet-server.",
          "type": "integer"
        },
        "rollout_duration_seconds": {
          "description": "The rollout duration (in seconds) provided for an action execution when scheduled by fleet-server.",
          "type": "integer"
        },
        "type": {
          "description": "The action type. INPUT_ACTION is the value for the actions that suppose to be routed to the endpoints/beats.",
          "type": "string"
        },
        "input_type": {
          "description": "The input type the actions should be routed to.",
          "type": "string"
        },
        "timeout": {
          "description": "The optional action timeout in seconds",
          "type": "integer"
        },
        "user_id": {
          "description": "The ID of the user who created the action.",
          "type": "string"
        },
        "traceparent": {
          "description": "APM traceparent for the action.",
          "type": "string"
        },
        "agents": {
          "description": "The Agent IDs the action is intended for. No support for json.RawMessage with the current generator. Could be useful to lazy parse the agent ids",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "data": {
          "description": "The opaque payload.",
          "format": "raw"
        },
        "signed": {
            "$ref": "#/definitions/signed"
        }
      },
      "required": [
        "id"
      ]
    },

    "signed": {
      "description": "The action signed data and signature.",
      "type": "object",
      "properties": {
        "data": {
          "description": "The base64 encoded, UTF-8 JSON serialized action bytes that are signed.",
          "type": "string"
        },
        "signature": {
          "description": "The base64 encoded signature.",
          "type": "string"
        }
      },
      "required": [
          "data",
          "signature"
      ]
    },

    "action-result": {
      "title": "Agent action results",
      "description": "An Elastic Agent action results",
      "type": "object",
      "properties": {
        "@timestamp": {
          "description": "Date/time the action was created",
          "type": "string",
          "format": "date-time"
        },
        "agent_id": {
          "description": "The agent id.",
          "type": "string"
        },
        "action_id": {
          "description": "The action id.",
          "type": "string"
        },
        "action_input_type": {
          "description": "The input type of the original action.",
          "type": "string"
        },
        "started_at": {
          "description": "Date/time the action was started",
          "type": "string",
          "format": "date-time"
        },
        "completed_at": {
          "description": "Date/time the action was completed",
          "type": "string",
          "format": "date-time"
        },
        "action_data": {
          "description": "The opaque payload.",
          "format": "raw"
        },
        "action_response": {
          "description": "The custom action response payload.",
          "format": "raw"
        },
        "error": {
          "description": "The action error message.",
          "type": "string"
        },
        "data": {
          "description": "The opaque payload.",
          "format": "raw"
        }
      },
      "required": [
        "id",
        "agent",
        "action"
      ]
    },

    "agent-metadata": {
      "title": "Agent Metadata",
      "description": "An Elastic Agent metadata",
      "type": "object",
      "properties": {
        "id": {
          "description": "The unique identifier for the Elastic Agent",
          "type": "string",
          "format": "uuid"
        },
        "version": {
          "description": "The version of the Elastic Agent",
          "type": "string"
        }
      },
      "required": [
        "id",
        "version"
      ]
    },

    "artifact": {
      "title": "Artifact",
      "description": "An artifact served by Fleet",
      "type": "object",
      "properties": {
        "identifier": {
          "description": "Human readable artifact identifier",
          "type": "string"
        },
        "compression_algorithm": {
          "description": "Name of compression algorithm applied to artifact",
          "type": "string"
        },
        "encryption_algorithm": {
          "description": "Name of encryption algorithm applied to artifact",
          "type": "string"
        },
        "encoded_sha256": {
          "description": "SHA256 of artifact after encoding has been applied",
          "type": "string"
        },
        "encoded_size": {
          "description": "Size of artifact after encoding has been applied",
          "type": "integer"
        },
        "decoded_sha256": {
          "description": "SHA256 of artifact before encoding has been applied",
          "type": "string"
        },
        "decoded_size": {
          "description": "Size of artifact before encoding has been applied",
          "type": "integer"
        },
        "created": {
          "description": "Timestamp artifact was created",
          "type": "string",
          "format": "date-time"
        },
        "body": {
          "description": "Encoded artifact data",
          "format": "raw"
        },
        "package_name": {
          "description": "Name of the package that owns this artifact",
          "type": "string"
        }
      },
      "required": [
        "identifier",
        "compressionAlgorithm",
        "encodedSha256",
        "encodedSize",
        "decodedSha256",
        "decodedSize",
        "created",
        "body"
      ]
    },

    "host-metadata": {
      "title": "Host Metadata",
      "description": "The host metadata for the Elastic Agent",
      "type": "object",
      "properties": {
        "id": {
          "description": "The ID of the host",
          "type": "string"
        },
        "architecture": {
          "description": "The architecture for the Elastic Agent",
          "type": "string"
        },
        "name": {
          "description": "The hostname of the Elastic Agent",
          "type": "string"
        },
        "ip": {
          "description": "The IP addresses of the Elastic Agent",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "id",
        "architecture",
        "name"
      ]
    },

    "server-metadata": {
      "title": "Server Metadata",
      "description": "A Fleet Server metadata",
      "type": "object",
      "properties": {
        "id": {
          "description": "The unique identifier for the Fleet Server",
          "type": "string",
          "format": "uuid"
        },
        "version": {
          "description": "The version of the Fleet Server",
          "type": "string"
        }
      },
      "required": [
        "id",
        "version"
      ]
    },

    "server": {
      "title": "Server",
      "description": "A Fleet Server",
      "type": "object",
      "properties": {
        "@timestamp": {
          "description": "Date/time the server was updated",
          "type": "string",
          "format": "date-time"
        },
        "agent": { "$ref": "#/definitions/agent-metadata" },
        "host": { "$ref": "#/definitions/host-metadata" },
        "server": { "$ref":  "#/definitions/server-metadata" }
      },
      "required": [
        "agent",
        "host",
        "server"
      ]
    },

    "policy": {
      "title": "Policy",
      "description": "A policy that an Elastic Agent is attached to",
      "type": "object",
      "properties": {
        "@timestamp": {
          "description": "Date/time the policy revision was created",
          "type": "string",
          "format": "date-time"
        },
        "policy_id": {
          "description": "The ID of the policy",
          "type": "string",
          "format": "uuid"
        },
        "revision_idx": {
          "description": "The revision index of the policy",
          "type": "integer"
        },
        "coordinator_idx": {
          "description": "The coordinator index of the policy",
          "type": "integer"
        },
        "data": {
          "$ref": "#/definitions/policy-data"
        },
        "default_fleet_server": {
          "description": "True when this policy is the default policy to start Fleet Server",
          "type": "boolean"
        },
        "unenroll_timeout": {
          "description": "Timeout (seconds) that an Elastic Agent should be un-enrolled.",
          "type": "integer"
        }
      },
      "required": [
        "policy_id",
        "revision_idx",
        "coordinator_idx",
        "data",
        "default_fleet_server"
      ]
    },

    "policy-leader": {
      "title": "Policy Leader",
      "description": "The current leader Fleet Server for a policy",
      "type": "object",
      "properties": {
        "@timestamp": {
          "description": "Date/time the leader was taken or held",
          "type": "string",
          "format": "date-time"
        },
        "server": { "$ref":  "#/definitions/server-metadata" }
      },
      "required": [
        "server"
      ]
    },

    "to_retire_api_key_ids": {
      "type": "array",
      "items": {
        "description": "the Output API Keys that were replaced and should be retired",
        "type": "object",
        "properties": {
          "id": {
            "description": "API Key identifier",
            "type": "string"
          },
          "retired_at": {
            "description": "Date/time the API key was retired",
            "type": "string",
            "format": "date-time"
          },
          "output": {
            "description": "Output name where the API Key belongs",
            "type": "string"
          }
        }
      }
    },

    "policy_output" : {
      "type": "object",
      "description": "holds the needed data to manage the output API keys",
      "properties": {
        "api_key": {
          "description": "API key the Elastic Agent uses to authenticate with elasticsearch",
          "type": "string"
        },
        "to_retire_api_key_ids": {
          "description": "API keys to be invalidated on next agent ack",
          "$ref":  "#/definitions/to_retire_api_key_ids"
        },
        "api_key_id": {
          "description": "ID of the API key the Elastic Agent uses to authenticate with elasticsearch",
          "type": "string"
        },
        "permissions_hash": {
          "description": "The policy output permissions hash",
          "type": "string"
        },
        "type": {
          "description": "Type is the output type. Currently only Elasticsearch is supported.",
          "type": "string"
        }
      },
      "required": [
        "api_key",
        "api_key_history",
        "api_key_id",
        "permissions_hash",
        "type"
      ]
    },

    "output_health": {
      "description": "Output health represents a health state of an output",
      "type": "object",
      "properties": {
        "output": {
          "type": "string",
          "description": "Output ID"
        },
        "state": {
          "type": "string",
          "description": "Health state, can be HEALTHY or DEGRADED"
        },
        "message": {
          "type": "string",
          "description": "Long state message if unhealthy"
        },
        "@timestamp": {
          "type": "string",
          "description": "Timestamp of reported state"
        },
        "data_stream": {
          "type": "object",
          "properties": {
            "dataset": {
              "type": "string"
            },
            "type": {
              "type": "string"
            },
            "namespace": {
              "type": "string"
            }
          }
        }
      }
    },

    "agent": {
      "title": "Agent",
      "description": "An Elastic Agent that has enrolled into Fleet",
      "type": "object",
      "properties": {
        "_id": {
          "description": "The unique identifier for the Elastic Agent",
          "type": "string",
          "format": "uuid"
        },
        "_version": {
          "description": "The version of the document in the index",
          "type": "integer"
        },
        "shared_id": {
          "description": "Shared ID",
          "type": "string"
        },
        "enrollment_id": {
          "description": "Enrollment ID",
          "type": "string"
        },
        "type": {
          "description": "Type",
          "type": "string"
        },
        "active": {
          "description": "Active flag",
          "type": "boolean"
        },
        "enrolled_at": {
          "description": "Date/time the Elastic Agent enrolled",
          "type": "string",
          "format": "date-time"
        },
        "unenrolled_at": {
          "description": "Date/time the Elastic Agent unenrolled",
          "type": "string",
          "format": "date-time"
        },
        "unenrolled_reason": {
          "description": "Reason the Elastic Agent was unenrolled",
          "type": "string",
          "enum": ["manual", "timeout"]
        },
        "unenrollment_started_at": {
          "description": "Date/time the Elastic Agent unenrolled started",
          "type": "string",
          "format": "date-time"
        },
        "upgraded_at": {
          "description": "Date/time the Elastic Agent was last upgraded",
          "type": "string",
          "format": "date-time"
        },
        "upgrade_started_at": {
          "description": "Date/time the Elastic Agent started the current upgrade",
          "type": "string",
          "format": "date-time"
        },
        "upgrade_status": {
          "description": "Upgrade status",
          "type": "string"
        },
        "access_api_key_id": {
          "description": "ID of the API key the Elastic Agent must used to contact Fleet Server",
          "type": "string"
        },
        "agent": { "$ref": "#/definitions/agent-metadata" },
        "user_provided_metadata": {
          "description": "User provided metadata information for the Elastic Agent",
          "format": "raw"
        },
        "tags": {
          "description": "User provided tags for the Elastic Agent",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "local_metadata": {
          "description": "Local metadata information for the Elastic Agent",
          "format": "raw"
        },
        "policy_id": {
          "description": "The policy ID for the Elastic Agent",
          "type": "string",
          "format": "uuid"
        },
        "policy_revision_idx": {
          "description": "The current policy revision_idx for the Elastic Agent",
          "type": "integer"
        },
        "policy_coordinator_idx": {
          "description": "The current policy coordinator for the Elastic Agent",
          "type": "integer"
        },
        "policy_output_permissions_hash": {
          "description": "Deprecated. Use Outputs instead. The policy output permissions hash",
          "type": "string"
        },
        "last_updated": {
          "description": "Date/time the Elastic Agent was last updated",
          "type": "string",
          "format": "date-time"
        },
        "last_checkin": {
          "description": "Date/time the Elastic Agent checked in last time",
          "type": "string",
          "format": "date-time"
        },
        "last_checkin_status": {
          "description": "Last checkin status",
          "type": "string"
        },
        "last_checkin_message": {
          "description": "Last checkin message",
          "type": "string"
        },
        "components": {
          "description": "Elastic Agent components detailed status information",
          "format": "raw"
        },
        "default_api_key_id": {
          "description": "Deprecated. Use Outputs instead. ID of the API key the Elastic Agent uses to authenticate with elasticsearch",
          "type": "string"
        },
        "default_api_key": {
          "description": "Deprecated. Use Outputs instead. API key the Elastic Agent uses to authenticate with elasticsearch",
          "type": "string"
        },
        "default_api_key_history": {
          "description": "Deprecated. Use Outputs instead. Default API Key History",
          "$ref":  "#/definitions/to_retire_api_key_ids"
        },
        "outputs": {
          "description": "Outputs is the policy output data, mapping the output name to its data",
          "type": "object",
          "additionalProperties": {  "$ref":  "#/definitions/policy_output"}
        },
        "updated_at": {
          "description": "Date/time the Elastic Agent was last updated",
          "type": "string",
          "format": "date-time"
        },
        "packages": {
          "description": "Packages array",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "action_seq_no": {
          "description": "The last acknowledged action sequence number for the Elastic Agent",
          "type": "array",
          "items": {
            "type": "integer"
          }
        },
        "upgrade_details": {
            "description": "Additional upgrade status details.",
            "type": "object"
        }
      },
      "required": [
        "_id",
        "type",
        "active",
        "enrolled_at",
        "status"
      ]
    },

    "enrollment_api_key": {
      "title": "Enrollment API key",
      "description": "An Elastic Agent enrollment API key",
      "type": "object",
      "properties": {
        "active": {
          "description": "True when the key is active",
          "type": "boolean"
        },
        "api_key_id": {
          "description": "The unique identifier for the enrollment key, currently xid",
          "type": "string"
        },
        "api_key": {
          "description": "Api key",
          "type": "string"
        },
        "name": {
          "description": "Enrollment key name",
          "type": "string"
        },
        "policy_id": {
          "type": "string"
        },
        "expire_at": {
          "type": "string",
          "format": "date-time"
        },
        "created_at": {
          "type": "string",
          "format": "date-time"
        },
        "updated_at": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "api_key_id",
        "api_key"
      ]
    },

    "checkin": {
      "title": "Checkin",
      "description": "An Elastic Agent checkin to Fleet",
      "type": "object",
      "properties": {
        "_id": {
          "description": "The unique identifier for the Elastic Agent checkin",
          "type": "string",
          "format": "uuid"
        },
        "@timestamp": {
          "description": "Date/time the checkin was created",
          "type": "string",
          "format": "date-time"
        },
        "agent": { "$ref": "#/definitions/agent-metadata" },
        "host": { "$ref": "#/definitions/host-metadata" },
        "server": { "$ref": "#/definitions/server-metadata" },
        "status": {
          "description": "The current overall status of the Elastic Agent",
          "type": "string",
          "enum": ["enrolling", "healthy", "error", "degraded", "offline", "unenrolling", "upgrading"]
        },
        "message": {
          "description": "The current overall status message of the Elastic Agent",
          "type": "string"
        },
        "policy": {
          "title": "Checkin Policy",
          "description": "The current status of the applied policy",
          "type": "object",
          "properties": {
            "id": {
              "description": "The ID for the policy",
              "type": "string",
              "format": "uuid"
            },
            "revision": {
              "description": "The revision of the policy",
              "type": "integer"
            },
            "inputs": {
              "title": "Checkin Policy Input",
              "description": "The current input status per policy",
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "id": {
                    "description": "The ID for the input",
                    "type": "string",
                    "format": "uuid"
                  },
                  "template_id": {
                    "description": "The template ID for the input",
                    "type": "string",
                    "format": "uuid"
                  },
                  "status": {
                    "description": "The current status of the input",
                    "type": "string",
                    "enum": ["healthy", "error", "degraded"]
                  },
                  "message": {
                    "description": "The current status message of the intput",
                    "type": "string"
                  }
                },
                "required": [
                  "id",
                  "template_id",
                  "status",
                  "message"
                ]
              }
            }
          },
          "required": [
            "id",
            "revision",
            "inputs"
          ]
        }
      },
      "required": [
        "_id",
        "agent",
        "status",
        "message",
        "enrolled_at",
        "updated_at"
      ]
    },

    "policy-data": {
        "title": "Policy Data",
        "description": "The policy data that an agent needs to run",
        "type": "object",
        "properties": {
            "id": {
                "description": "The policy's ID",
                "type": "string"
            },
            "outputs": {
                "description": "A map of all outputs that the agent running the policy can use to send data to.",
                "type": "object",
                "additionalProperties": {
                    "type": "object",
                    "additionalProperties": {
                        "$comment": "results in map[string]map[string]interface{}. We use a dynamic output objects because it would be a larger task to define the properties we need to support for each output type, this may be done as future work"
                    }
                }
            },
            "inputs": {
                "description": "A list of all inputs the agent should run",
                "type": "array",
                "items": {
                    "type": "object",
                    "additionalProperties":{
                        "$comment": "embedded additionalProperties type results in `outputs map[string]interface{}`"
                    }
                }
            },
            "secret_references": {
                "description": "A list of all secrets fleet-server needs to inject into the policy before passing it to the agent. This attribute is removed when policy data is send to an agent.",
                "type": "array",
                "items": {
                    "type": "object",
                    "properties": {
                        "id": {
                            "type": "string"
                        }
                    },
                    "required": [
                        "id"
                    ]
                }
            },
            "revision": {
                "description": "The policy revision number. Should match revision_idx",
                "type": "integer"
            },
            "agent": {
                "description": "The policy's agent configuration details",
                "format": "raw"
            },
            "signed": {
                "$ref": "#/definitions/signed"
            },
            "output_permissions": {
                "description": "The Elasticsearch permissions needed to run the policy",
                "format": "raw"
            },
            "fleet": {
                "description": "The policy's fleet configuration details",
                "format": "raw"
            }
        },
        "required": [
            "id",
            "revision",
            "outputs"
        ]
    }
  }
}