[8.x] [Security Assistant] Add Knowledge Base entries API (#206407) (#208610)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Assistant] Add Knowledge Base entries API
(#206407)](https://github.com/elastic/kibana/pull/206407)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Patryk
Kopyciński","email":"contact@patrykkopycinski.com"},"sourceCommit":{"committedDate":"2025-01-28T19:19:55Z","message":"[Security
Assistant] Add Knowledge Base entries API (#206407)\n\n##
Summary\r\n\r\nExpose Knowledge Base entries
API\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b128cee4ee7ccc367e8acf159dbf58a75f081867","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","v9.0.0","Feature:Security
Assistant","Team:Security Generative
AI","backport:version","v8.18.0"],"title":"[Security Assistant] Add
Knowledge Base entries
API","number":206407,"url":"https://github.com/elastic/kibana/pull/206407","mergeCommit":{"message":"[Security
Assistant] Add Knowledge Base entries API (#206407)\n\n##
Summary\r\n\r\nExpose Knowledge Base entries
API\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b128cee4ee7ccc367e8acf159dbf58a75f081867"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/206407","number":206407,"mergeCommit":{"message":"[Security
Assistant] Add Knowledge Base entries API (#206407)\n\n##
Summary\r\n\r\nExpose Knowledge Base entries
API\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b128cee4ee7ccc367e8acf159dbf58a75f081867"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: Patryk Kopyciński <contact@patrykkopycinski.com>

oas_docs/output/kibana.serverless.yaml

@@ -33584,6 +33584,349 @@ paths:
       tags:
         - Security AI Assistant API
       x-beta: true
+  /api/security_ai_assistant/knowledge_base/{resource}:
+    get:
+      description: Read a single KB
+      operationId: ReadKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  elser_exists:
+                    type: boolean
+                  index_exists:
+                    type: boolean
+                  is_setup_available:
+                    type: boolean
+                  is_setup_in_progress:
+                    type: boolean
+                  pipeline_exists:
+                    type: boolean
+                  security_labs_exists:
+                    type: boolean
+                  user_data_exists:
+                    type: boolean
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Read a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+    post:
+      description: Create a KnowledgeBase
+      operationId: CreateKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+        - description: Optional ELSER modelId to use when setting up the Knowledge Base
+          in: query
+          name: modelId
+          required: false
+          schema:
+            type: string
+        - description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base
+          in: query
+          name: ignoreSecurityLabs
+          required: false
+          schema:
+            default: false
+            type: boolean
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Create a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+  /api/security_ai_assistant/knowledge_base/entries:
+    post:
+      description: Create a Knowledge Base Entry
+      operationId: CreateKnowledgeBaseEntry
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning Knowledge Base Entries
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Create a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
+    post:
+      description: The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs
+      operationId: PerformKnowledgeBaseEntryBulkAction
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              type: object
+              properties:
+                create:
+                  items:
+                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
+                  type: array
+                delete:
+                  type: object
+                  properties:
+                    ids:
+                      description: Array of Knowledge base Entry IDs
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    query:
+                      description: Query to filter Knowledge Base Entries
+                      type: string
+                update:
+                  items:
+                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
+                  type: array
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
+          description: Successful bulk operation request
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Applies a bulk action to multiple Knowledge Base Entries
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+  /api/security_ai_assistant/knowledge_base/entries/_find:
+    get:
+      description: Finds Knowledge Base Entries that match the given query.
+      operationId: FindKnowledgeBaseEntries
+      parameters:
+        - in: query
+          name: fields
+          required: false
+          schema:
+            items:
+              type: string
+            type: array
+        - description: Search query
+          in: query
+          name: filter
+          required: false
+          schema:
+            type: string
+        - description: Field to sort by
+          in: query
+          name: sort_field
+          required: false
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
+        - description: Sort order
+          in: query
+          name: sort_order
+          required: false
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
+        - description: Page number
+          in: query
+          name: page
+          required: false
+          schema:
+            default: 1
+            minimum: 1
+            type: integer
+        - description: Knowledge Base Entries per page
+          in: query
+          name: per_page
+          required: false
+          schema:
+            default: 20
+            minimum: 0
+            type: integer
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+                    type: array
+                  page:
+                    type: integer
+                  perPage:
+                    type: integer
+                  total:
+                    type: integer
+                required:
+                  - page
+                  - perPage
+                  - total
+                  - data
+          description: Successful response
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Finds Knowledge Base Entries that match the given query.
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+  /api/security_ai_assistant/knowledge_base/entries/{id}:
+    delete:
+      description: Deletes a single Knowledge Base Entry using the `id` field
+      operationId: DeleteKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
+          description: Successful request returning the deleted Knowledge Base Entry's ID
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Deletes a single Knowledge Base Entry using the `id` field
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+    get:
+      description: Read a Knowledge Base Entry
+      operationId: ReadKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value.
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning a Knowledge Base Entry
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Read a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+      x-beta: true
+    put:
+      description: Update a Knowledge Base Entry
+      operationId: UpdateKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning the updated Knowledge Base Entry
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Update a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+      x-beta: true
   /api/security_ai_assistant/prompts/_bulk_action:
     post:
       description: Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs.
@@ -39871,6 +40214,107 @@ components:
           type: string
       required:
         - id
+    Security_AI_Assistant_API_DeleteResponseFields:
+      type: object
+      properties:
+        id:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      required:
+        - id
+    Security_AI_Assistant_API_DocumentEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields'
+    Security_AI_Assistant_API_DocumentEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
+    Security_AI_Assistant_API_DocumentEntryOptionalFields:
+      type: object
+      properties:
+        required:
+          description: Whether this resource should always be included, defaults to false
+          type: boolean
+        vector:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_Vector'
+    Security_AI_Assistant_API_DocumentEntryRequiredFields:
+      type: object
+      properties:
+        kbResource:
+          description: Knowledge Base resource name for grouping entries, e.g. 'esql', 'lens-docs', etc
+          type: string
+        source:
+          description: Source document name or filepath
+          type: string
+        text:
+          description: Knowledge Base Entry content
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - document
+          type: string
+      required:
+        - type
+        - kbResource
+        - source
+        - text
+    Security_AI_Assistant_API_DocumentEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
+    Security_AI_Assistant_API_DocumentEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
     Security_AI_Assistant_API_FindAnonymizationFieldsSortField:
       enum:
         - created_at
@@ -39886,6 +40330,13 @@ components:
         - title
         - updated_at
       type: string
+    Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField:
+      enum:
+        - created_at
+        - is_default
+        - title
+        - updated_at
+      type: string
     Security_AI_Assistant_API_FindPromptsSortField:
       enum:
         - created_at
@@ -39893,6 +40344,256 @@ components:
         - name
         - updated_at
       type: string
+    Security_AI_Assistant_API_IndexEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields'
+    Security_AI_Assistant_API_IndexEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
+    Security_AI_Assistant_API_IndexEntryOptionalFields:
+      type: object
+      properties:
+        inputSchema:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_InputSchema'
+        outputFields:
+          description: Fields to extract from the query result, defaults to all fields if not provided or empty
+          items:
+            type: string
+          type: array
+    Security_AI_Assistant_API_IndexEntryRequiredFields:
+      type: object
+      properties:
+        description:
+          description: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description
+          type: string
+        field:
+          description: Field to query for Knowledge Base content
+          type: string
+        index:
+          description: Index or Data Stream to query for Knowledge Base content
+          type: string
+        queryDescription:
+          description: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - index
+          type: string
+      required:
+        - type
+        - index
+        - field
+        - description
+        - queryDescription
+    Security_AI_Assistant_API_IndexEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
+    Security_AI_Assistant_API_IndexEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
+    Security_AI_Assistant_API_InputSchema:
+      description: Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval
+      items:
+        type: object
+        properties:
+          description:
+            description: Description of the field
+            type: string
+          fieldName:
+            description: Name of the field
+            type: string
+          fieldType:
+            description: Type of the field
+            type: string
+        required:
+          - fieldName
+          - fieldType
+          - description
+      type: array
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason:
+      enum:
+        - KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
+      type: string
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        skip_reason:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason'
+      required:
+        - id
+        - skip_reason
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            errors:
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError'
+              type: array
+            results:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults'
+            summary:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary'
+          required:
+            - results
+            - summary
+        knowledgeBaseEntriesCount:
+          type: integer
+        message:
+          type: string
+        statusCode:
+          type: integer
+        success:
+          type: boolean
+      required:
+        - attributes
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults:
+      type: object
+      properties:
+        created:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          type: array
+        deleted:
+          items:
+            type: string
+          type: array
+        skipped:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult'
+          type: array
+        updated:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          type: array
+      required:
+        - updated
+        - created
+        - deleted
+        - skipped
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary:
+      type: object
+      properties:
+        failed:
+          type: integer
+        skipped:
+          type: integer
+        succeeded:
+          type: integer
+        total:
+          type: integer
+      required:
+        - failed
+        - skipped
+        - succeeded
+        - total
+    Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      required:
+        - id
+    Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema:
+      additionalProperties: false
+      type: object
+      properties:
+        error:
+          type: string
+        message:
+          type: string
+        statusCode:
+          type: number
+      required:
+        - statusCode
+        - error
+        - message
+    Security_AI_Assistant_API_KnowledgeBaseEntryResponse:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseResponse:
+      description: AI assistant KnowledgeBase.
+      type: object
+      properties:
+        success:
+          description: Identify the success of the method execution.
+          type: boolean
     Security_AI_Assistant_API_Message:
       description: AI assistant conversation message.
       type: object
@@ -39951,6 +40652,23 @@ components:
         - message
         - status_code
         - anonymization_fields
+    Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError:
+      type: object
+      properties:
+        err_code:
+          type: string
+        knowledgeBaseEntries:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError'
+          type: array
+        message:
+          type: string
+        statusCode:
+          type: integer
+      required:
+        - message
+        - statusCode
+        - knowledgeBaseEntries
     Security_AI_Assistant_API_NormalizedPromptError:
       type: object
       properties:
@@ -40156,6 +40874,29 @@ components:
         type: string
       description: Replacements object used to anonymize/deanomymize messsages
       type: object
+    Security_AI_Assistant_API_ResponseFields:
+      type: object
+      properties:
+        createdAt:
+          description: Time the Knowledge Base Entry was created
+          type: string
+        createdBy:
+          description: User who created the Knowledge Base Entry
+          type: string
+        id:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+        updatedAt:
+          description: Time the Knowledge Base Entry was last updated
+          type: string
+        updatedBy:
+          description: User who last updated the Knowledge Base Entry
+          type: string
+      required:
+        - id
+        - createdAt
+        - createdBy
+        - updatedAt
+        - updatedBy
     Security_AI_Assistant_API_SortOrder:
       enum:
         - asc
@@ -40181,6 +40922,21 @@ components:
         name:
           description: User name
           type: string
+    Security_AI_Assistant_API_Vector:
+      description: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
+      type: object
+      properties:
+        modelId:
+          description: ID of the model used to create the embeddings
+          type: string
+        tokens:
+          additionalProperties:
+            type: number
+          description: Tokens with their corresponding values
+          type: object
+      required:
+        - modelId
+        - tokens
     Security_Detections_API_AlertAssignees:
       type: object
       properties:

oas_docs/output/kibana.yaml

@@ -17606,6 +17606,341 @@ paths:
       summary: Update a conversation
       tags:
         - Security AI Assistant API
+  /api/security_ai_assistant/knowledge_base/{resource}:
+    get:
+      description: Read a single KB
+      operationId: ReadKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  elser_exists:
+                    type: boolean
+                  index_exists:
+                    type: boolean
+                  is_setup_available:
+                    type: boolean
+                  is_setup_in_progress:
+                    type: boolean
+                  pipeline_exists:
+                    type: boolean
+                  security_labs_exists:
+                    type: boolean
+                  user_data_exists:
+                    type: boolean
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Read a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+    post:
+      description: Create a KnowledgeBase
+      operationId: CreateKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+        - description: Optional ELSER modelId to use when setting up the Knowledge Base
+          in: query
+          name: modelId
+          required: false
+          schema:
+            type: string
+        - description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base
+          in: query
+          name: ignoreSecurityLabs
+          required: false
+          schema:
+            default: false
+            type: boolean
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Create a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+  /api/security_ai_assistant/knowledge_base/entries:
+    post:
+      description: Create a Knowledge Base Entry
+      operationId: CreateKnowledgeBaseEntry
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning Knowledge Base Entries
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Create a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
+    post:
+      description: The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs
+      operationId: PerformKnowledgeBaseEntryBulkAction
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              type: object
+              properties:
+                create:
+                  items:
+                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
+                  type: array
+                delete:
+                  type: object
+                  properties:
+                    ids:
+                      description: Array of Knowledge base Entry IDs
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    query:
+                      description: Query to filter Knowledge Base Entries
+                      type: string
+                update:
+                  items:
+                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
+                  type: array
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
+          description: Successful bulk operation request
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Applies a bulk action to multiple Knowledge Base Entries
+      tags:
+        - Security AI Assistant API
+  /api/security_ai_assistant/knowledge_base/entries/_find:
+    get:
+      description: Finds Knowledge Base Entries that match the given query.
+      operationId: FindKnowledgeBaseEntries
+      parameters:
+        - in: query
+          name: fields
+          required: false
+          schema:
+            items:
+              type: string
+            type: array
+        - description: Search query
+          in: query
+          name: filter
+          required: false
+          schema:
+            type: string
+        - description: Field to sort by
+          in: query
+          name: sort_field
+          required: false
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
+        - description: Sort order
+          in: query
+          name: sort_order
+          required: false
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
+        - description: Page number
+          in: query
+          name: page
+          required: false
+          schema:
+            default: 1
+            minimum: 1
+            type: integer
+        - description: Knowledge Base Entries per page
+          in: query
+          name: per_page
+          required: false
+          schema:
+            default: 20
+            minimum: 0
+            type: integer
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+                    type: array
+                  page:
+                    type: integer
+                  perPage:
+                    type: integer
+                  total:
+                    type: integer
+                required:
+                  - page
+                  - perPage
+                  - total
+                  - data
+          description: Successful response
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Finds Knowledge Base Entries that match the given query.
+      tags:
+        - Security AI Assistant API
+  /api/security_ai_assistant/knowledge_base/entries/{id}:
+    delete:
+      description: Deletes a single Knowledge Base Entry using the `id` field
+      operationId: DeleteKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
+          description: Successful request returning the deleted Knowledge Base Entry's ID
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Deletes a single Knowledge Base Entry using the `id` field
+      tags:
+        - Security AI Assistant API
+    get:
+      description: Read a Knowledge Base Entry
+      operationId: ReadKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value.
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning a Knowledge Base Entry
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Read a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+    put:
+      description: Update a Knowledge Base Entry
+      operationId: UpdateKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      requestBody:
+        content:
+          application/json; Elastic-Api-Version=2023-10-31:
+            schema:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          description: Successful request returning the updated Knowledge Base Entry
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Update a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
   /api/security_ai_assistant/prompts/_bulk_action:
     post:
       description: Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs.
@@ -28069,6 +28404,107 @@ components:
           type: string
       required:
         - id
+    Security_AI_Assistant_API_DeleteResponseFields:
+      type: object
+      properties:
+        id:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+      required:
+        - id
+    Security_AI_Assistant_API_DocumentEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields'
+    Security_AI_Assistant_API_DocumentEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
+    Security_AI_Assistant_API_DocumentEntryOptionalFields:
+      type: object
+      properties:
+        required:
+          description: Whether this resource should always be included, defaults to false
+          type: boolean
+        vector:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_Vector'
+    Security_AI_Assistant_API_DocumentEntryRequiredFields:
+      type: object
+      properties:
+        kbResource:
+          description: Knowledge Base resource name for grouping entries, e.g. 'esql', 'lens-docs', etc
+          type: string
+        source:
+          description: Source document name or filepath
+          type: string
+        text:
+          description: Knowledge Base Entry content
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - document
+          type: string
+      required:
+        - type
+        - kbResource
+        - source
+        - text
+    Security_AI_Assistant_API_DocumentEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
+    Security_AI_Assistant_API_DocumentEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
     Security_AI_Assistant_API_FindAnonymizationFieldsSortField:
       enum:
         - created_at
@@ -28084,6 +28520,13 @@ components:
         - title
         - updated_at
       type: string
+    Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField:
+      enum:
+        - created_at
+        - is_default
+        - title
+        - updated_at
+      type: string
     Security_AI_Assistant_API_FindPromptsSortField:
       enum:
         - created_at
@@ -28091,6 +28534,256 @@ components:
         - name
         - updated_at
       type: string
+    Security_AI_Assistant_API_IndexEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields'
+    Security_AI_Assistant_API_IndexEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
+    Security_AI_Assistant_API_IndexEntryOptionalFields:
+      type: object
+      properties:
+        inputSchema:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_InputSchema'
+        outputFields:
+          description: Fields to extract from the query result, defaults to all fields if not provided or empty
+          items:
+            type: string
+          type: array
+    Security_AI_Assistant_API_IndexEntryRequiredFields:
+      type: object
+      properties:
+        description:
+          description: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description
+          type: string
+        field:
+          description: Field to query for Knowledge Base content
+          type: string
+        index:
+          description: Index or Data Stream to query for Knowledge Base content
+          type: string
+        queryDescription:
+          description: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - index
+          type: string
+      required:
+        - type
+        - index
+        - field
+        - description
+        - queryDescription
+    Security_AI_Assistant_API_IndexEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
+    Security_AI_Assistant_API_IndexEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: Kibana Space, defaults to 'default' space
+              type: string
+            users:
+              description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
+    Security_AI_Assistant_API_InputSchema:
+      description: Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval
+      items:
+        type: object
+        properties:
+          description:
+            description: Description of the field
+            type: string
+          fieldName:
+            description: Name of the field
+            type: string
+          fieldType:
+            description: Type of the field
+            type: string
+        required:
+          - fieldName
+          - fieldType
+          - description
+      type: array
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason:
+      enum:
+        - KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
+      type: string
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        skip_reason:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason'
+      required:
+        - id
+        - skip_reason
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            errors:
+              items:
+                $ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError'
+              type: array
+            results:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults'
+            summary:
+              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary'
+          required:
+            - results
+            - summary
+        knowledgeBaseEntriesCount:
+          type: integer
+        message:
+          type: string
+        statusCode:
+          type: integer
+        success:
+          type: boolean
+      required:
+        - attributes
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults:
+      type: object
+      properties:
+        created:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          type: array
+        deleted:
+          items:
+            type: string
+          type: array
+        skipped:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult'
+          type: array
+        updated:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
+          type: array
+      required:
+        - updated
+        - created
+        - deleted
+        - skipped
+    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary:
+      type: object
+      properties:
+        failed:
+          type: integer
+        skipped:
+          type: integer
+        succeeded:
+          type: integer
+        total:
+          type: integer
+      required:
+        - failed
+        - skipped
+        - succeeded
+        - total
+    Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      required:
+        - id
+    Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema:
+      additionalProperties: false
+      type: object
+      properties:
+        error:
+          type: string
+        message:
+          type: string
+        statusCode:
+          type: number
+      required:
+        - statusCode
+        - error
+        - message
+    Security_AI_Assistant_API_KnowledgeBaseEntryResponse:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps:
+      anyOf:
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
+        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
+      discriminator:
+        propertyName: type
+    Security_AI_Assistant_API_KnowledgeBaseResponse:
+      description: AI assistant KnowledgeBase.
+      type: object
+      properties:
+        success:
+          description: Identify the success of the method execution.
+          type: boolean
     Security_AI_Assistant_API_Message:
       description: AI assistant conversation message.
       type: object
@@ -28149,6 +28842,23 @@ components:
         - message
         - status_code
         - anonymization_fields
+    Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError:
+      type: object
+      properties:
+        err_code:
+          type: string
+        knowledgeBaseEntries:
+          items:
+            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError'
+          type: array
+        message:
+          type: string
+        statusCode:
+          type: integer
+      required:
+        - message
+        - statusCode
+        - knowledgeBaseEntries
     Security_AI_Assistant_API_NormalizedPromptError:
       type: object
       properties:
@@ -28354,6 +29064,29 @@ components:
         type: string
       description: Replacements object used to anonymize/deanomymize messsages
       type: object
+    Security_AI_Assistant_API_ResponseFields:
+      type: object
+      properties:
+        createdAt:
+          description: Time the Knowledge Base Entry was created
+          type: string
+        createdBy:
+          description: User who created the Knowledge Base Entry
+          type: string
+        id:
+          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
+        updatedAt:
+          description: Time the Knowledge Base Entry was last updated
+          type: string
+        updatedBy:
+          description: User who last updated the Knowledge Base Entry
+          type: string
+      required:
+        - id
+        - createdAt
+        - createdBy
+        - updatedAt
+        - updatedBy
     Security_AI_Assistant_API_SortOrder:
       enum:
         - asc
@@ -28379,6 +29112,21 @@ components:
         name:
           description: User name
           type: string
+    Security_AI_Assistant_API_Vector:
+      description: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
+      type: object
+      properties:
+        modelId:
+          description: ID of the model used to create the embeddings
+          type: string
+        tokens:
+          additionalProperties:
+            type: number
+          description: Tokens with their corresponding values
+          type: object
+      required:
+        - modelId
+        - tokens
     Security_Detections_API_AlertAssignees:
       type: object
       properties:

x-pack/platform/packages/shared/kbn-elastic-assistant-common/constants.ts

@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export const ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION = '1';
-
 export const ELASTIC_AI_ASSISTANT_URL = '/api/security_ai_assistant';
 export const ELASTIC_AI_ASSISTANT_INTERNAL_URL = '/internal/elastic_assistant';
 
@@ -43,16 +41,18 @@ export const ELASTIC_AI_ASSISTANT_ANONYMIZATION_FIELDS_URL_FIND =
 
 // TODO: Update existing 'status' endpoint to take resource as query param as to not conflict with 'entries'
 export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL =
-  `${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/knowledge_base/{resource?}` as const;
+  `${ELASTIC_AI_ASSISTANT_URL}/knowledge_base/{resource?}` as const;
 export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL =
-  `${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/knowledge_base/entries` as const;
+  `${ELASTIC_AI_ASSISTANT_URL}/knowledge_base/entries` as const;
+export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID =
+  `${ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL}/{id}` as const;
 export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND =
   `${ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL}/_find` as const;
 export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION =
   `${ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL}/_bulk_action` as const;
+
 export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_INDICES_URL =
   `${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/knowledge_base/_indices` as const;
-
 export const ELASTIC_AI_ASSISTANT_EVALUATE_URL =
   `${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/evaluate` as const;
 

x-pack/platform/packages/shared/kbn-elastic-assistant-common/docs/openapi/ess/elastic_assistant_api_2023_10_31.bundled.schema.yaml

@@ -418,6 +418,353 @@ paths:
       tags:
         - Security AI Assistant API
         - Conversation API
+  '/api/security_ai_assistant/knowledge_base/{resource}':
+    get:
+      description: Read a single KB
+      operationId: ReadKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  elser_exists:
+                    type: boolean
+                  index_exists:
+                    type: boolean
+                  is_setup_available:
+                    type: boolean
+                  is_setup_in_progress:
+                    type: boolean
+                  pipeline_exists:
+                    type: boolean
+                  security_labs_exists:
+                    type: boolean
+                  user_data_exists:
+                    type: boolean
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Read a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+        - KnowledgeBase API
+    post:
+      description: Create a KnowledgeBase
+      operationId: CreateKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+        - description: Optional ELSER modelId to use when setting up the Knowledge Base
+          in: query
+          name: modelId
+          required: false
+          schema:
+            type: string
+        - description: >-
+            Indicates whether we should or should not install Security Labs docs
+            when setting up the Knowledge Base
+          in: query
+          name: ignoreSecurityLabs
+          required: false
+          schema:
+            default: false
+            type: boolean
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseResponse'
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Create a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+        - KnowledgeBase API
+  /api/security_ai_assistant/knowledge_base/entries:
+    post:
+      description: Create a Knowledge Base Entry
+      operationId: CreateKnowledgeBaseEntry
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/KnowledgeBaseEntryCreateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning Knowledge Base Entries
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Create a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
+    post:
+      description: >-
+        The bulk action is applied to all Knowledge Base Entries that match the
+        filter or to the list of Knowledge Base Entries by their IDs
+      operationId: PerformKnowledgeBaseEntryBulkAction
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                create:
+                  items:
+                    $ref: '#/components/schemas/KnowledgeBaseEntryCreateProps'
+                  type: array
+                delete:
+                  type: object
+                  properties:
+                    ids:
+                      description: Array of Knowledge base Entry IDs
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    query:
+                      description: Query to filter Knowledge Base Entries
+                      type: string
+                update:
+                  items:
+                    $ref: '#/components/schemas/KnowledgeBaseEntryUpdateProps'
+                  type: array
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionResponse'
+          description: Successful bulk operation request
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Applies a bulk action to multiple Knowledge Base Entries
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries Bulk API
+  /api/security_ai_assistant/knowledge_base/entries/_find:
+    get:
+      description: Finds Knowledge Base Entries that match the given query.
+      operationId: FindKnowledgeBaseEntries
+      parameters:
+        - in: query
+          name: fields
+          required: false
+          schema:
+            items:
+              type: string
+            type: array
+        - description: Search query
+          in: query
+          name: filter
+          required: false
+          schema:
+            type: string
+        - description: Field to sort by
+          in: query
+          name: sort_field
+          required: false
+          schema:
+            $ref: '#/components/schemas/FindKnowledgeBaseEntriesSortField'
+        - description: Sort order
+          in: query
+          name: sort_order
+          required: false
+          schema:
+            $ref: '#/components/schemas/SortOrder'
+        - description: Page number
+          in: query
+          name: page
+          required: false
+          schema:
+            default: 1
+            minimum: 1
+            type: integer
+        - description: Knowledge Base Entries per page
+          in: query
+          name: per_page
+          required: false
+          schema:
+            default: 20
+            minimum: 0
+            type: integer
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+                    type: array
+                  page:
+                    type: integer
+                  perPage:
+                    type: integer
+                  total:
+                    type: integer
+                required:
+                  - page
+                  - perPage
+                  - total
+                  - data
+          description: Successful response
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Finds Knowledge Base Entries that match the given query.
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+  '/api/security_ai_assistant/knowledge_base/entries/{id}':
+    delete:
+      description: Deletes a single Knowledge Base Entry using the `id` field
+      operationId: DeleteKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DeleteResponseFields'
+          description: Successful request returning the deleted Knowledge Base Entry's ID
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Deletes a single Knowledge Base Entry using the `id` field
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+    get:
+      description: Read a Knowledge Base Entry
+      operationId: ReadKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value.
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning a Knowledge Base Entry
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Read a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+    put:
+      description: Update a Knowledge Base Entry
+      operationId: UpdateKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/KnowledgeBaseEntryUpdateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning the updated Knowledge Base Entry
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Update a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
   /api/security_ai_assistant/prompts/_bulk_action:
     post:
       description: >-
@@ -919,6 +1266,115 @@ components:
           type: string
       required:
         - id
+    DeleteResponseFields:
+      type: object
+      properties:
+        id:
+          $ref: '#/components/schemas/NonEmptyString'
+      required:
+        - id
+    DocumentEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/ResponseFields'
+        - $ref: '#/components/schemas/DocumentEntryResponseFields'
+    DocumentEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/DocumentEntryOptionalFields'
+    DocumentEntryOptionalFields:
+      type: object
+      properties:
+        required:
+          description: 'Whether this resource should always be included, defaults to false'
+          type: boolean
+        vector:
+          $ref: '#/components/schemas/Vector'
+    DocumentEntryRequiredFields:
+      type: object
+      properties:
+        kbResource:
+          description: >-
+            Knowledge Base resource name for grouping entries, e.g. 'esql',
+            'lens-docs', etc
+          type: string
+        source:
+          description: Source document name or filepath
+          type: string
+        text:
+          description: Knowledge Base Entry content
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - document
+          type: string
+      required:
+        - type
+        - kbResource
+        - source
+        - text
+    DocumentEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/DocumentEntryOptionalFields'
+    DocumentEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/DocumentEntryCreateFields'
     FindAnonymizationFieldsSortField:
       enum:
         - created_at
@@ -934,6 +1390,13 @@ components:
         - title
         - updated_at
       type: string
+    FindKnowledgeBaseEntriesSortField:
+      enum:
+        - created_at
+        - is_default
+        - title
+        - updated_at
+      type: string
     FindPromptsSortField:
       enum:
         - created_at
@@ -941,6 +1404,270 @@ components:
         - name
         - updated_at
       type: string
+    IndexEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/ResponseFields'
+        - $ref: '#/components/schemas/IndexEntryResponseFields'
+    IndexEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/IndexEntryOptionalFields'
+    IndexEntryOptionalFields:
+      type: object
+      properties:
+        inputSchema:
+          $ref: '#/components/schemas/InputSchema'
+        outputFields:
+          description: >-
+            Fields to extract from the query result, defaults to all fields if
+            not provided or empty
+          items:
+            type: string
+          type: array
+    IndexEntryRequiredFields:
+      type: object
+      properties:
+        description:
+          description: >-
+            Description for when this index or data stream should be queried for
+            Knowledge Base content. Passed to the LLM as a tool description
+          type: string
+        field:
+          description: Field to query for Knowledge Base content
+          type: string
+        index:
+          description: Index or Data Stream to query for Knowledge Base content
+          type: string
+        queryDescription:
+          description: >-
+            Description of query field used to fetch Knowledge Base content.
+            Passed to the LLM as part of the tool input schema
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - index
+          type: string
+      required:
+        - type
+        - index
+        - field
+        - description
+        - queryDescription
+    IndexEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/IndexEntryOptionalFields'
+    IndexEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/IndexEntryCreateFields'
+    InputSchema:
+      description: >-
+        Array of objects defining the input schema, allowing the LLM to extract
+        structured data to be used in retrieval
+      items:
+        type: object
+        properties:
+          description:
+            description: Description of the field
+            type: string
+          fieldName:
+            description: Name of the field
+            type: string
+          fieldType:
+            description: Type of the field
+            type: string
+        required:
+          - fieldName
+          - fieldType
+          - description
+      type: array
+    KnowledgeBaseEntryBulkActionSkipReason:
+      enum:
+        - KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
+      type: string
+    KnowledgeBaseEntryBulkActionSkipResult:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        skip_reason:
+          $ref: '#/components/schemas/KnowledgeBaseEntryBulkActionSkipReason'
+      required:
+        - id
+        - skip_reason
+    KnowledgeBaseEntryBulkCrudActionResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            errors:
+              items:
+                $ref: '#/components/schemas/NormalizedKnowledgeBaseEntryError'
+              type: array
+            results:
+              $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionResults'
+            summary:
+              $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionSummary'
+          required:
+            - results
+            - summary
+        knowledgeBaseEntriesCount:
+          type: integer
+        message:
+          type: string
+        statusCode:
+          type: integer
+        success:
+          type: boolean
+      required:
+        - attributes
+    KnowledgeBaseEntryBulkCrudActionResults:
+      type: object
+      properties:
+        created:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          type: array
+        deleted:
+          items:
+            type: string
+          type: array
+        skipped:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryBulkActionSkipResult'
+          type: array
+        updated:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          type: array
+      required:
+        - updated
+        - created
+        - deleted
+        - skipped
+    KnowledgeBaseEntryBulkCrudActionSummary:
+      type: object
+      properties:
+        failed:
+          type: integer
+        skipped:
+          type: integer
+        succeeded:
+          type: integer
+        total:
+          type: integer
+      required:
+        - failed
+        - skipped
+        - succeeded
+        - total
+    KnowledgeBaseEntryCreateProps:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntryCreateFields'
+        - $ref: '#/components/schemas/IndexEntryCreateFields'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseEntryDetailsInError:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      required:
+        - id
+    KnowledgeBaseEntryErrorSchema:
+      additionalProperties: false
+      type: object
+      properties:
+        error:
+          type: string
+        message:
+          type: string
+        statusCode:
+          type: number
+      required:
+        - statusCode
+        - error
+        - message
+    KnowledgeBaseEntryResponse:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntry'
+        - $ref: '#/components/schemas/IndexEntry'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseEntryUpdateProps:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntryUpdateFields'
+        - $ref: '#/components/schemas/IndexEntryUpdateFields'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseResponse:
+      description: AI assistant KnowledgeBase.
+      type: object
+      properties:
+        success:
+          description: Identify the success of the method execution.
+          type: boolean
     Message:
       description: AI assistant conversation message.
       type: object
@@ -999,6 +1726,23 @@ components:
         - message
         - status_code
         - anonymization_fields
+    NormalizedKnowledgeBaseEntryError:
+      type: object
+      properties:
+        err_code:
+          type: string
+        knowledgeBaseEntries:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryDetailsInError'
+          type: array
+        message:
+          type: string
+        statusCode:
+          type: integer
+      required:
+        - message
+        - statusCode
+        - knowledgeBaseEntries
     NormalizedPromptError:
       type: object
       properties:
@@ -1204,6 +1948,29 @@ components:
         type: string
       description: Replacements object used to anonymize/deanomymize messsages
       type: object
+    ResponseFields:
+      type: object
+      properties:
+        createdAt:
+          description: Time the Knowledge Base Entry was created
+          type: string
+        createdBy:
+          description: User who created the Knowledge Base Entry
+          type: string
+        id:
+          $ref: '#/components/schemas/NonEmptyString'
+        updatedAt:
+          description: Time the Knowledge Base Entry was last updated
+          type: string
+        updatedBy:
+          description: User who last updated the Knowledge Base Entry
+          type: string
+      required:
+        - id
+        - createdAt
+        - createdBy
+        - updatedAt
+        - updatedBy
     SortOrder:
       enum:
         - asc
@@ -1229,6 +1996,23 @@ components:
         name:
           description: User name
           type: string
+    Vector:
+      description: >-
+        Object containing Knowledge Base Entry text embeddings and modelId used
+        to create the embeddings
+      type: object
+      properties:
+        modelId:
+          description: ID of the model used to create the embeddings
+          type: string
+        tokens:
+          additionalProperties:
+            type: number
+          description: Tokens with their corresponding values
+          type: object
+      required:
+        - modelId
+        - tokens
   securitySchemes:
     BasicAuth:
       scheme: basic

x-pack/platform/packages/shared/kbn-elastic-assistant-common/docs/openapi/serverless/elastic_assistant_api_2023_10_31.bundled.schema.yaml

@@ -418,6 +418,353 @@ paths:
       tags:
         - Security AI Assistant API
         - Conversation API
+  '/api/security_ai_assistant/knowledge_base/{resource}':
+    get:
+      description: Read a single KB
+      operationId: ReadKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  elser_exists:
+                    type: boolean
+                  index_exists:
+                    type: boolean
+                  is_setup_available:
+                    type: boolean
+                  is_setup_in_progress:
+                    type: boolean
+                  pipeline_exists:
+                    type: boolean
+                  security_labs_exists:
+                    type: boolean
+                  user_data_exists:
+                    type: boolean
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Read a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+        - KnowledgeBase API
+    post:
+      description: Create a KnowledgeBase
+      operationId: CreateKnowledgeBase
+      parameters:
+        - description: The KnowledgeBase `resource` value.
+          in: path
+          name: resource
+          schema:
+            type: string
+        - description: Optional ELSER modelId to use when setting up the Knowledge Base
+          in: query
+          name: modelId
+          required: false
+          schema:
+            type: string
+        - description: >-
+            Indicates whether we should or should not install Security Labs docs
+            when setting up the Knowledge Base
+          in: query
+          name: ignoreSecurityLabs
+          required: false
+          schema:
+            default: false
+            type: boolean
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseResponse'
+          description: Indicates a successful call.
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Create a KnowledgeBase
+      tags:
+        - Security AI Assistant API
+        - KnowledgeBase API
+  /api/security_ai_assistant/knowledge_base/entries:
+    post:
+      description: Create a Knowledge Base Entry
+      operationId: CreateKnowledgeBaseEntry
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/KnowledgeBaseEntryCreateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning Knowledge Base Entries
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Create a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
+    post:
+      description: >-
+        The bulk action is applied to all Knowledge Base Entries that match the
+        filter or to the list of Knowledge Base Entries by their IDs
+      operationId: PerformKnowledgeBaseEntryBulkAction
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                create:
+                  items:
+                    $ref: '#/components/schemas/KnowledgeBaseEntryCreateProps'
+                  type: array
+                delete:
+                  type: object
+                  properties:
+                    ids:
+                      description: Array of Knowledge base Entry IDs
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    query:
+                      description: Query to filter Knowledge Base Entries
+                      type: string
+                update:
+                  items:
+                    $ref: '#/components/schemas/KnowledgeBaseEntryUpdateProps'
+                  type: array
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionResponse'
+          description: Successful bulk operation request
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Applies a bulk action to multiple Knowledge Base Entries
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries Bulk API
+  /api/security_ai_assistant/knowledge_base/entries/_find:
+    get:
+      description: Finds Knowledge Base Entries that match the given query.
+      operationId: FindKnowledgeBaseEntries
+      parameters:
+        - in: query
+          name: fields
+          required: false
+          schema:
+            items:
+              type: string
+            type: array
+        - description: Search query
+          in: query
+          name: filter
+          required: false
+          schema:
+            type: string
+        - description: Field to sort by
+          in: query
+          name: sort_field
+          required: false
+          schema:
+            $ref: '#/components/schemas/FindKnowledgeBaseEntriesSortField'
+        - description: Sort order
+          in: query
+          name: sort_order
+          required: false
+          schema:
+            $ref: '#/components/schemas/SortOrder'
+        - description: Page number
+          in: query
+          name: page
+          required: false
+          schema:
+            default: 1
+            minimum: 1
+            type: integer
+        - description: Knowledge Base Entries per page
+          in: query
+          name: per_page
+          required: false
+          schema:
+            default: 20
+            minimum: 0
+            type: integer
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    items:
+                      $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+                    type: array
+                  page:
+                    type: integer
+                  perPage:
+                    type: integer
+                  total:
+                    type: integer
+                required:
+                  - page
+                  - perPage
+                  - total
+                  - data
+          description: Successful response
+        '400':
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                  message:
+                    type: string
+                  statusCode:
+                    type: number
+          description: Generic Error
+      summary: Finds Knowledge Base Entries that match the given query.
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+  '/api/security_ai_assistant/knowledge_base/entries/{id}':
+    delete:
+      description: Deletes a single Knowledge Base Entry using the `id` field
+      operationId: DeleteKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DeleteResponseFields'
+          description: Successful request returning the deleted Knowledge Base Entry's ID
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Deletes a single Knowledge Base Entry using the `id` field
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+    get:
+      description: Read a Knowledge Base Entry
+      operationId: ReadKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value.
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning a Knowledge Base Entry
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Read a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
+    put:
+      description: Update a Knowledge Base Entry
+      operationId: UpdateKnowledgeBaseEntry
+      parameters:
+        - description: The Knowledge Base Entry's `id` value
+          in: path
+          name: id
+          required: true
+          schema:
+            $ref: '#/components/schemas/NonEmptyString'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/KnowledgeBaseEntryUpdateProps'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          description: Successful request returning the updated Knowledge Base Entry
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/KnowledgeBaseEntryErrorSchema'
+          description: Generic Error
+      summary: Update a Knowledge Base Entry
+      tags:
+        - Security AI Assistant API
+        - Knowledge Base Entries API
   /api/security_ai_assistant/prompts/_bulk_action:
     post:
       description: >-
@@ -919,6 +1266,115 @@ components:
           type: string
       required:
         - id
+    DeleteResponseFields:
+      type: object
+      properties:
+        id:
+          $ref: '#/components/schemas/NonEmptyString'
+      required:
+        - id
+    DocumentEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/ResponseFields'
+        - $ref: '#/components/schemas/DocumentEntryResponseFields'
+    DocumentEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/DocumentEntryOptionalFields'
+    DocumentEntryOptionalFields:
+      type: object
+      properties:
+        required:
+          description: 'Whether this resource should always be included, defaults to false'
+          type: boolean
+        vector:
+          $ref: '#/components/schemas/Vector'
+    DocumentEntryRequiredFields:
+      type: object
+      properties:
+        kbResource:
+          description: >-
+            Knowledge Base resource name for grouping entries, e.g. 'esql',
+            'lens-docs', etc
+          type: string
+        source:
+          description: Source document name or filepath
+          type: string
+        text:
+          description: Knowledge Base Entry content
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - document
+          type: string
+      required:
+        - type
+        - kbResource
+        - source
+        - text
+    DocumentEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/DocumentEntryRequiredFields'
+        - $ref: '#/components/schemas/DocumentEntryOptionalFields'
+    DocumentEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/DocumentEntryCreateFields'
     FindAnonymizationFieldsSortField:
       enum:
         - created_at
@@ -934,6 +1390,13 @@ components:
         - title
         - updated_at
       type: string
+    FindKnowledgeBaseEntriesSortField:
+      enum:
+        - created_at
+        - is_default
+        - title
+        - updated_at
+      type: string
     FindPromptsSortField:
       enum:
         - created_at
@@ -941,6 +1404,270 @@ components:
         - name
         - updated_at
       type: string
+    IndexEntry:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+            - namespace
+            - users
+        - $ref: '#/components/schemas/ResponseFields'
+        - $ref: '#/components/schemas/IndexEntryResponseFields'
+    IndexEntryCreateFields:
+      allOf:
+        - type: object
+          properties:
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - name
+        - $ref: '#/components/schemas/IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/IndexEntryOptionalFields'
+    IndexEntryOptionalFields:
+      type: object
+      properties:
+        inputSchema:
+          $ref: '#/components/schemas/InputSchema'
+        outputFields:
+          description: >-
+            Fields to extract from the query result, defaults to all fields if
+            not provided or empty
+          items:
+            type: string
+          type: array
+    IndexEntryRequiredFields:
+      type: object
+      properties:
+        description:
+          description: >-
+            Description for when this index or data stream should be queried for
+            Knowledge Base content. Passed to the LLM as a tool description
+          type: string
+        field:
+          description: Field to query for Knowledge Base content
+          type: string
+        index:
+          description: Index or Data Stream to query for Knowledge Base content
+          type: string
+        queryDescription:
+          description: >-
+            Description of query field used to fetch Knowledge Base content.
+            Passed to the LLM as part of the tool input schema
+          type: string
+        type:
+          description: Entry type
+          enum:
+            - index
+          type: string
+      required:
+        - type
+        - index
+        - field
+        - description
+        - queryDescription
+    IndexEntryResponseFields:
+      allOf:
+        - $ref: '#/components/schemas/IndexEntryRequiredFields'
+        - $ref: '#/components/schemas/IndexEntryOptionalFields'
+    IndexEntryUpdateFields:
+      allOf:
+        - type: object
+          properties:
+            id:
+              $ref: '#/components/schemas/NonEmptyString'
+            name:
+              description: Name of the Knowledge Base Entry
+              type: string
+            namespace:
+              description: 'Kibana Space, defaults to ''default'' space'
+              type: string
+            users:
+              description: >-
+                Users who have access to the Knowledge Base Entry, defaults to
+                current user. Empty array provides access to all users.
+              items:
+                $ref: '#/components/schemas/User'
+              type: array
+          required:
+            - id
+        - $ref: '#/components/schemas/IndexEntryCreateFields'
+    InputSchema:
+      description: >-
+        Array of objects defining the input schema, allowing the LLM to extract
+        structured data to be used in retrieval
+      items:
+        type: object
+        properties:
+          description:
+            description: Description of the field
+            type: string
+          fieldName:
+            description: Name of the field
+            type: string
+          fieldType:
+            description: Type of the field
+            type: string
+        required:
+          - fieldName
+          - fieldType
+          - description
+      type: array
+    KnowledgeBaseEntryBulkActionSkipReason:
+      enum:
+        - KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
+      type: string
+    KnowledgeBaseEntryBulkActionSkipResult:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        skip_reason:
+          $ref: '#/components/schemas/KnowledgeBaseEntryBulkActionSkipReason'
+      required:
+        - id
+        - skip_reason
+    KnowledgeBaseEntryBulkCrudActionResponse:
+      type: object
+      properties:
+        attributes:
+          type: object
+          properties:
+            errors:
+              items:
+                $ref: '#/components/schemas/NormalizedKnowledgeBaseEntryError'
+              type: array
+            results:
+              $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionResults'
+            summary:
+              $ref: '#/components/schemas/KnowledgeBaseEntryBulkCrudActionSummary'
+          required:
+            - results
+            - summary
+        knowledgeBaseEntriesCount:
+          type: integer
+        message:
+          type: string
+        statusCode:
+          type: integer
+        success:
+          type: boolean
+      required:
+        - attributes
+    KnowledgeBaseEntryBulkCrudActionResults:
+      type: object
+      properties:
+        created:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          type: array
+        deleted:
+          items:
+            type: string
+          type: array
+        skipped:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryBulkActionSkipResult'
+          type: array
+        updated:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryResponse'
+          type: array
+      required:
+        - updated
+        - created
+        - deleted
+        - skipped
+    KnowledgeBaseEntryBulkCrudActionSummary:
+      type: object
+      properties:
+        failed:
+          type: integer
+        skipped:
+          type: integer
+        succeeded:
+          type: integer
+        total:
+          type: integer
+      required:
+        - failed
+        - skipped
+        - succeeded
+        - total
+    KnowledgeBaseEntryCreateProps:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntryCreateFields'
+        - $ref: '#/components/schemas/IndexEntryCreateFields'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseEntryDetailsInError:
+      type: object
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+      required:
+        - id
+    KnowledgeBaseEntryErrorSchema:
+      additionalProperties: false
+      type: object
+      properties:
+        error:
+          type: string
+        message:
+          type: string
+        statusCode:
+          type: number
+      required:
+        - statusCode
+        - error
+        - message
+    KnowledgeBaseEntryResponse:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntry'
+        - $ref: '#/components/schemas/IndexEntry'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseEntryUpdateProps:
+      anyOf:
+        - $ref: '#/components/schemas/DocumentEntryUpdateFields'
+        - $ref: '#/components/schemas/IndexEntryUpdateFields'
+      discriminator:
+        propertyName: type
+    KnowledgeBaseResponse:
+      description: AI assistant KnowledgeBase.
+      type: object
+      properties:
+        success:
+          description: Identify the success of the method execution.
+          type: boolean
     Message:
       description: AI assistant conversation message.
       type: object
@@ -999,6 +1726,23 @@ components:
         - message
         - status_code
         - anonymization_fields
+    NormalizedKnowledgeBaseEntryError:
+      type: object
+      properties:
+        err_code:
+          type: string
+        knowledgeBaseEntries:
+          items:
+            $ref: '#/components/schemas/KnowledgeBaseEntryDetailsInError'
+          type: array
+        message:
+          type: string
+        statusCode:
+          type: integer
+      required:
+        - message
+        - statusCode
+        - knowledgeBaseEntries
     NormalizedPromptError:
       type: object
       properties:
@@ -1204,6 +1948,29 @@ components:
         type: string
       description: Replacements object used to anonymize/deanomymize messsages
       type: object
+    ResponseFields:
+      type: object
+      properties:
+        createdAt:
+          description: Time the Knowledge Base Entry was created
+          type: string
+        createdBy:
+          description: User who created the Knowledge Base Entry
+          type: string
+        id:
+          $ref: '#/components/schemas/NonEmptyString'
+        updatedAt:
+          description: Time the Knowledge Base Entry was last updated
+          type: string
+        updatedBy:
+          description: User who last updated the Knowledge Base Entry
+          type: string
+      required:
+        - id
+        - createdAt
+        - createdBy
+        - updatedAt
+        - updatedBy
     SortOrder:
       enum:
         - asc
@@ -1229,6 +1996,23 @@ components:
         name:
           description: User name
           type: string
+    Vector:
+      description: >-
+        Object containing Knowledge Base Entry text embeddings and modelId used
+        to create the embeddings
+      type: object
+      properties:
+        modelId:
+          description: ID of the model used to create the embeddings
+          type: string
+        tokens:
+          additionalProperties:
+            type: number
+          description: Tokens with their corresponding values
+          type: object
+      required:
+        - modelId
+        - tokens
   securitySchemes:
     BasicAuth:
       scheme: basic

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/crud_kb_route.gen.ts

@@ -11,7 +11,7 @@
  *
  * info:
  *   title: KnowledgeBase API endpoints
- *   version: 1
+ *   version: 2023-10-31
  */
 
 import { z } from '@kbn/zod';

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/crud_kb_route.schema.yaml

@@ -1,9 +1,9 @@
 openapi: 3.0.0
 info:
   title: KnowledgeBase API endpoints
-  version: '1'
+  version: '2023-10-31'
 paths:
-  /internal/elastic_assistant/knowledge_base/{resource}:
+  /api/security_ai_assistant/knowledge_base/{resource}:
     post:
       x-codegen-enabled: true
       x-labels: [ess, serverless]

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/bulk_crud_knowledge_base_entries_route.gen.ts

@@ -11,7 +11,7 @@
  *
  * info:
  *   title: Bulk Knowledge Base Actions API endpoint
- *   version: 1
+ *   version: 2023-10-31
  */
 
 import { z } from '@kbn/zod';

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/bulk_crud_knowledge_base_entries_route.http

@@ -1,5 +1,5 @@
 ### Empty Bulk Action
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries/_bulk_action
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries/_bulk_action
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/bulk_crud_knowledge_base_entries_route.schema.yaml

@@ -1,13 +1,11 @@
 openapi: 3.0.0
 info:
   title: Bulk Knowledge Base Actions API endpoint
-  version: '1'
+  version: '2023-10-31'
 paths:
-  /internal/elastic_assistant/knowledge_base/entries/_bulk_action:
+  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
     post:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: PerformKnowledgeBaseEntryBulkAction
       summary: Applies a bulk action to multiple Knowledge Base Entries

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/common_attributes.gen.ts

@@ -136,6 +136,11 @@ export const ResponseFields = z.object({
   updatedBy: z.string(),
 });
 
+export type DeleteResponseFields = z.infer<typeof DeleteResponseFields>;
+export const DeleteResponseFields = z.object({
+  id: NonEmptyString,
+});
+
 export type SharedResponseProps = z.infer<typeof SharedResponseProps>;
 export const SharedResponseProps = BaseResponseProps.merge(ResponseFields);
 
@@ -250,3 +255,6 @@ export const KnowledgeBaseEntryUpdateProps = z.discriminatedUnion('type', [
 
 export type KnowledgeBaseEntryResponse = z.infer<typeof KnowledgeBaseEntryResponse>;
 export const KnowledgeBaseEntryResponse = z.discriminatedUnion('type', [DocumentEntry, IndexEntry]);
+
+export type KnowledgeBaseEntryDeleteResponse = z.infer<typeof KnowledgeBaseEntryDeleteResponse>;
+export const KnowledgeBaseEntryDeleteResponse = DeleteResponseFields;

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/common_attributes.schema.yaml

@@ -150,6 +150,14 @@ components:
         - updatedAt
         - updatedBy
 
+    DeleteResponseFields:
+      type: object
+      properties:
+        id:
+          $ref: "../../common_attributes.schema.yaml#/components/schemas/NonEmptyString"
+      required:
+        - id
+
     SharedResponseProps:
       x-inline: true
       allOf:
@@ -306,3 +314,7 @@ components:
       anyOf:
         - $ref: "#/components/schemas/DocumentEntry"
         - $ref: "#/components/schemas/IndexEntry"
+
+    KnowledgeBaseEntryDeleteResponse:
+      allOf:
+        - $ref: "#/components/schemas/DeleteResponseFields"

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/crud_knowledge_base_entries_route.gen.ts

@@ -11,7 +11,7 @@
  *
  * info:
  *   title: Manage Knowledge Base Entries API endpoint
- *   version: 1
+ *   version: 2023-10-31
  */
 
 import { z } from '@kbn/zod';
@@ -20,6 +20,7 @@ import {
   KnowledgeBaseEntryCreateProps,
   KnowledgeBaseEntryResponse,
   KnowledgeBaseEntryUpdateProps,
+  DeleteResponseFields,
 } from './common_attributes.gen';
 import { NonEmptyString } from '../../common_attributes.gen';
 
@@ -48,7 +49,7 @@ export type DeleteKnowledgeBaseEntryRequestParamsInput = z.input<
 >;
 
 export type DeleteKnowledgeBaseEntryResponse = z.infer<typeof DeleteKnowledgeBaseEntryResponse>;
-export const DeleteKnowledgeBaseEntryResponse = KnowledgeBaseEntryResponse;
+export const DeleteKnowledgeBaseEntryResponse = DeleteResponseFields;
 
 export type ReadKnowledgeBaseEntryRequestParams = z.infer<
   typeof ReadKnowledgeBaseEntryRequestParams

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/crud_knowledge_base_entries_route.http

@@ -1,5 +1,5 @@
 ### Create Document Entry [Admin] [Private]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -16,7 +16,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Document Entry [Admin] [Global]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -34,7 +34,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Document Entry [Assistant All] [Private]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -51,7 +51,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Document Entry [Assistant All] [Global]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -69,7 +69,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Index Entry [Admin] [Private]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -89,7 +89,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Index Entry [Admin] [Global]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -110,7 +110,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Index Entry [Assistant All] [Private]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}
@@ -129,7 +129,7 @@ X-Kbn-Context: {{appContext.security}}
 }
 
 ### Create Index Entry [Assistant All] [Global]
-POST http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries
+POST http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries
 kbn-xsrf: "true"
 Content-Type: application/json
 Elastic-Api-Version: {{elasticApiVersion}}

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/crud_knowledge_base_entries_route.schema.yaml

@@ -1,13 +1,11 @@
 openapi: 3.0.0
 info:
   title: Manage Knowledge Base Entries API endpoint
-  version: '1'
+  version: '2023-10-31'
 paths:
-  /internal/elastic_assistant/knowledge_base/entries:
+  /api/security_ai_assistant/knowledge_base/entries:
     post:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: CreateKnowledgeBaseEntry
       description: Create a Knowledge Base Entry
@@ -34,11 +32,9 @@ paths:
               schema:
                 $ref: './common_attributes.schema.yaml#/components/schemas/KnowledgeBaseEntryErrorSchema'
 
-  /internal/elastic_assistant/knowledge_base/entries/{id}:
+  /api/security_ai_assistant/knowledge_base/entries/{id}:
     get:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: ReadKnowledgeBaseEntry
       description: Read a Knowledge Base Entry
@@ -67,8 +63,6 @@ paths:
                 $ref: './common_attributes.schema.yaml#/components/schemas/KnowledgeBaseEntryErrorSchema'
     put:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: UpdateKnowledgeBaseEntry
       description: Update a Knowledge Base Entry
@@ -103,8 +97,6 @@ paths:
                 $ref: './common_attributes.schema.yaml#/components/schemas/KnowledgeBaseEntryErrorSchema'
     delete:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: DeleteKnowledgeBaseEntry
       description: Deletes a single Knowledge Base Entry using the `id` field
@@ -120,11 +112,11 @@ paths:
             $ref: '../../common_attributes.schema.yaml#/components/schemas/NonEmptyString'
       responses:
         200:
-          description: Successful request returning the deleted Knowledge Base Entry
+          description: Successful request returning the deleted Knowledge Base Entry's ID
           content:
             application/json:
               schema:
-                $ref: './common_attributes.schema.yaml#/components/schemas/KnowledgeBaseEntryResponse'
+                $ref: './common_attributes.schema.yaml#/components/schemas/DeleteResponseFields'
         400:
           description: Generic Error
           content:

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/find_knowledge_base_entries_route.gen.ts

@@ -11,7 +11,7 @@
  *
  * info:
  *   title: Find Knowledge Base Entries API endpoint
- *   version: 1
+ *   version: 2023-10-31
  */
 
 import { z } from '@kbn/zod';

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/find_knowledge_base_entries_route.http

@@ -1,5 +1,5 @@
 ### Find all knowledge base entries
-GET http://{{host}}:{{port}}{{basePath}}/internal/elastic_assistant/knowledge_base/entries/_find
+GET http://{{host}}:{{port}}{{basePath}}/api/security_ai_assistant/knowledge_base/entries/_find
 Elastic-Api-Version: {{elasticApiVersion}}
 Authorization: Basic {{auth.admin.username}} {{auth.admin.password}}
 X-Kbn-Context: {{appContext.security}}

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/entries/find_knowledge_base_entries_route.schema.yaml

@@ -1,13 +1,11 @@
 openapi: 3.0.0
 info:
   title: Find Knowledge Base Entries API endpoint
-  version: '1'
+  version: '2023-10-31'
 paths:
-  /internal/elastic_assistant/knowledge_base/entries/_find:
+  /api/security_ai_assistant/knowledge_base/entries/_find:
     get:
       x-codegen-enabled: true
-      # Targeted to update to public by 8.18
-      x-internal: true
       x-labels: [ess, serverless]
       operationId: FindKnowledgeBaseEntries
       description: Finds Knowledge Base Entries that match the given query.

x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/knowledge_base/get_knowledge_base_indices_route.schema.yaml

@@ -6,6 +6,7 @@ paths:
   /internal/elastic_assistant/knowledge_base/_indices:
     get:
       x-codegen-enabled: true
+      x-internal: true
       x-labels: [ess, serverless]
       operationId: GetKnowledgeBaseIndices
       description: Gets Knowledge Base indices that have fields of a `sematic_text` type.

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/api.test.tsx

@@ -8,6 +8,7 @@
 import { HttpSetup } from '@kbn/core-http-browser';
 
 import { getKnowledgeBaseIndices, getKnowledgeBaseStatus, postKnowledgeBase } from './api';
+import { API_VERSIONS } from '@kbn/spaces-plugin/common';
 
 jest.mock('@kbn/core-http-browser');
 
@@ -30,11 +31,11 @@ describe('API tests', () => {
       await getKnowledgeBaseStatus(knowledgeBaseArgs);
 
       expect(mockHttp.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/a-resource',
+        '/api/security_ai_assistant/knowledge_base/a-resource',
         {
           method: 'GET',
           signal: undefined,
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       );
     });
@@ -55,11 +56,11 @@ describe('API tests', () => {
       await postKnowledgeBase(knowledgeBaseArgs);
 
       expect(mockHttp.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/a-resource',
+        '/api/security_ai_assistant/knowledge_base/a-resource',
         {
           method: 'POST',
           signal: undefined,
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       );
     });

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/api.tsx

@@ -40,7 +40,7 @@ export const getKnowledgeBaseStatus = async ({
     const response = await http.fetch(path, {
       method: 'GET',
       signal,
-      version: API_VERSIONS.internal.v1,
+      version: API_VERSIONS.public.v1,
     });
 
     return response as ReadKnowledgeBaseResponse;
@@ -71,7 +71,7 @@ export const postKnowledgeBase = async ({
   const response = await http.fetch(path, {
     method: 'POST',
     signal,
-    version: API_VERSIONS.internal.v1,
+    version: API_VERSIONS.public.v1,
   });
 
   return response as CreateKnowledgeBaseResponse;

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_create_knowledge_base_entry.tsx

@@ -20,7 +20,7 @@ import { useInvalidateKnowledgeBaseEntries } from './use_knowledge_base_entries'
 
 const CREATE_KNOWLEDGE_BASE_ENTRY_MUTATION_KEY = [
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
-  API_VERSIONS.internal.v1,
+  API_VERSIONS.public.v1,
 ];
 
 export interface UseCreateKnowledgeBaseEntryParams {
@@ -54,7 +54,7 @@ export const useCreateKnowledgeBaseEntry = ({
         ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
         {
           body: JSON.stringify(entry),
-          version: API_VERSIONS.internal.v1,
+          version: API_VERSIONS.public.v1,
           signal,
         }
       );

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_delete_knowledge_base_entries.test.tsx

@@ -11,6 +11,7 @@ import {
   UseDeleteKnowledgeEntriesParams,
 } from './use_delete_knowledge_base_entries';
 import { useInvalidateKnowledgeBaseEntries } from './use_knowledge_base_entries';
+import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 
 jest.mock('./use_knowledge_base_entries', () => ({
   useInvalidateKnowledgeBaseEntries: jest.fn(),
@@ -66,7 +67,7 @@ describe('useDeleteKnowledgeBaseEntries', () => {
       expect.any(String),
       expect.objectContaining({
         body: JSON.stringify({ delete: { query: '', ids: ['1'] } }),
-        version: '1',
+        version: API_VERSIONS.public.v1,
       })
     );
     expect(invalidateKnowledgeBaseEntries).toHaveBeenCalled();

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_delete_knowledge_base_entries.tsx

@@ -21,7 +21,7 @@ import { useInvalidateKnowledgeBaseEntries } from './use_knowledge_base_entries'
 
 const DELETE_KNOWLEDGE_BASE_ENTRIES_MUTATION_KEY = [
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
-  API_VERSIONS.internal.v1,
+  API_VERSIONS.public.v1,
 ];
 
 export interface UseDeleteKnowledgeEntriesParams {
@@ -61,7 +61,7 @@ export const useDeleteKnowledgeBaseEntries = ({
         ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
         {
           body: JSON.stringify(body),
-          version: API_VERSIONS.internal.v1,
+          version: API_VERSIONS.public.v1,
           signal,
         }
       );

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_knowledge_base_entries.ts

@@ -36,7 +36,7 @@ export const KNOWLEDGE_BASE_ENTRY_QUERY_KEY = [
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
   defaultQuery.page,
   defaultQuery.per_page,
-  API_VERSIONS.internal.v1,
+  API_VERSIONS.public.v1,
 ];
 
 /**
@@ -66,7 +66,7 @@ export const useKnowledgeBaseEntries = ({
         ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
         {
           method: 'GET',
-          version: API_VERSIONS.internal.v1,
+          version: API_VERSIONS.public.v1,
           query,
           signal,
         }

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_update_knowledge_base_entries.test.tsx

@@ -11,6 +11,7 @@ import {
   UseUpdateKnowledgeBaseEntriesParams,
 } from './use_update_knowledge_base_entries';
 import { useInvalidateKnowledgeBaseEntries } from './use_knowledge_base_entries';
+import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 
 jest.mock('./use_knowledge_base_entries', () => ({
   useInvalidateKnowledgeBaseEntries: jest.fn(),
@@ -67,7 +68,7 @@ describe('useUpdateKnowledgeBaseEntries', () => {
       expect.any(String),
       expect.objectContaining({
         body: JSON.stringify({ update: defaultArgs }),
-        version: '1',
+        version: API_VERSIONS.public.v1,
       })
     );
     expect(invalidateKnowledgeBaseEntries).toHaveBeenCalled();

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/entries/use_update_knowledge_base_entries.tsx

@@ -20,7 +20,7 @@ import { useInvalidateKnowledgeBaseEntries } from './use_knowledge_base_entries'
 
 const BULK_UPDATE_KNOWLEDGE_BASE_ENTRY_MUTATION_KEY = [
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
-  API_VERSIONS.internal.v1,
+  API_VERSIONS.public.v1,
   'UPDATE',
 ];
 
@@ -58,7 +58,7 @@ export const useUpdateKnowledgeBaseEntries = ({
         ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
         {
           body: JSON.stringify(body),
-          version: API_VERSIONS.internal.v1,
+          version: API_VERSIONS.public.v1,
           signal,
         }
       );

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/use_knowledge_base_status.test.tsx

@@ -8,6 +8,7 @@
 import { waitFor, renderHook } from '@testing-library/react';
 import { useKnowledgeBaseStatus, UseKnowledgeBaseStatusParams } from './use_knowledge_base_status';
 import { getKnowledgeBaseStatus as _getKnowledgeBaseStatus } from './api';
+import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 
 const getKnowledgeBaseStatusMock = _getKnowledgeBaseStatus as jest.Mock;
 
@@ -52,11 +53,11 @@ describe('useKnowledgeBaseStatus', () => {
     renderHook(() => useKnowledgeBaseStatus(defaultProps));
     await waitFor(() => {
       expect(defaultProps.http.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/',
+        '/api/security_ai_assistant/knowledge_base/',
         {
           method: 'GET',
           signal: undefined,
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       );
       expect(toasts.addError).not.toHaveBeenCalled();
@@ -66,11 +67,11 @@ describe('useKnowledgeBaseStatus', () => {
     renderHook(() => useKnowledgeBaseStatus({ ...defaultProps, resource: 'something' }));
     await waitFor(() =>
       expect(defaultProps.http.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/something',
+        '/api/security_ai_assistant/knowledge_base/something',
         {
           method: 'GET',
           signal: undefined,
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       )
     );

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/knowledge_base/use_setup_knowledge_base.test.tsx

@@ -9,6 +9,7 @@ import { waitFor, renderHook } from '@testing-library/react';
 import { useSetupKnowledgeBase, UseSetupKnowledgeBaseParams } from './use_setup_knowledge_base';
 import { postKnowledgeBase as _postKnowledgeBase } from './api';
 import { useMutation as _useMutation } from '@tanstack/react-query';
+import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 
 const postKnowledgeBaseMock = _postKnowledgeBase as jest.Mock;
 const useMutationMock = _useMutation as jest.Mock;
@@ -53,10 +54,10 @@ describe('useSetupKnowledgeBase', () => {
     renderHook(() => useSetupKnowledgeBase(defaultProps));
     await waitFor(() => {
       expect(defaultProps.http.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/',
+        '/api/security_ai_assistant/knowledge_base/',
         {
           method: 'POST',
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       );
       expect(toasts.addError).not.toHaveBeenCalled();
@@ -75,10 +76,10 @@ describe('useSetupKnowledgeBase', () => {
     renderHook(() => useSetupKnowledgeBase(defaultProps));
     await waitFor(() =>
       expect(defaultProps.http.fetch).toHaveBeenCalledWith(
-        '/internal/elastic_assistant/knowledge_base/something',
+        '/api/security_ai_assistant/knowledge_base/something',
         {
           method: 'POST',
-          version: '1',
+          version: API_VERSIONS.public.v1,
         }
       )
     );

x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json

@@ -38,5 +38,6 @@
     "@kbn/core-chrome-browser",
     "@kbn/ai-assistant-icon",
     "@kbn/product-doc-base-plugin",
+    "@kbn/spaces-plugin",
   ]
 }

x-pack/solutions/security/plugins/elastic_assistant/server/__mocks__/data_clients.mock.ts

@@ -60,6 +60,8 @@ const createKnowledgeBaseDataClientMock = () => {
     addKnowledgeBaseDocuments: jest.fn(),
     createInferenceEndpoint: jest.fn(),
     createKnowledgeBaseEntry: jest.fn(),
+    updateKnowledgeBaseEntry: jest.fn(),
+    deleteKnowledgeBaseEntry: jest.fn(),
     findDocuments: jest.fn(),
     getAssistantTools: jest.fn(),
     getKnowledgeBaseDocumentEntries: jest.fn(),

x-pack/solutions/security/plugins/elastic_assistant/server/__mocks__/request.ts

@@ -14,6 +14,9 @@ import {
 import type {
   DefendInsightsGetRequestQuery,
   DefendInsightsPostRequestBody,
+  DeleteKnowledgeBaseEntryRequestParams,
+  KnowledgeBaseEntryUpdateProps,
+  UpdateKnowledgeBaseEntryRequestParams,
 } from '@kbn/elastic-assistant-common';
 import {
   AttackDiscoveryPostRequestBody,
@@ -31,6 +34,7 @@ import {
   ELASTIC_AI_ASSISTANT_EVALUATE_URL,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
+  ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_INDICES_URL,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
@@ -94,6 +98,27 @@ export const getBulkActionKnowledgeBaseEntryRequest = (
     body,
   });
 
+export const getUpdateKnowledgeBaseEntryRequest = ({
+  params,
+  body,
+}: {
+  params: UpdateKnowledgeBaseEntryRequestParams;
+  body: KnowledgeBaseEntryUpdateProps;
+}) =>
+  requestMock.create({
+    method: 'put',
+    path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+    params,
+    body,
+  });
+
+export const getDeleteKnowledgeBaseEntryRequest = (params: DeleteKnowledgeBaseEntryRequestParams) =>
+  requestMock.create({
+    method: 'delete',
+    path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+    params,
+  });
+
 export const getGetCapabilitiesRequest = () =>
   requestMock.create({
     method: 'get',

x-pack/solutions/security/plugins/elastic_assistant/server/ai_assistant_data_clients/knowledge_base/index.ts

@@ -22,6 +22,7 @@ import {
   KnowledgeBaseEntryCreateProps,
   KnowledgeBaseEntryResponse,
   Metadata,
+  KnowledgeBaseEntryUpdateProps,
 } from '@kbn/elastic-assistant-common';
 import pRetry from 'p-retry';
 import { StructuredTool } from '@langchain/core/tools';
@@ -30,21 +31,36 @@ import { IndexPatternsFetcher } from '@kbn/data-views-plugin/server';
 import { map } from 'lodash';
 import { AIAssistantDataClient, AIAssistantDataClientParams } from '..';
 import { GetElser } from '../../types';
-import { createKnowledgeBaseEntry, transformToCreateSchema } from './create_knowledge_base_entry';
-import { EsDocumentEntry, EsIndexEntry, EsKnowledgeBaseEntrySchema } from './types';
-import { transformESSearchToKnowledgeBaseEntry } from './transforms';
+import {
+  createKnowledgeBaseEntry,
+  getUpdateScript,
+  transformToCreateSchema,
+  transformToUpdateSchema,
+} from './create_knowledge_base_entry';
+import {
+  EsDocumentEntry,
+  EsIndexEntry,
+  EsKnowledgeBaseEntrySchema,
+  UpdateKnowledgeBaseEntrySchema,
+} from './types';
+import { transformESSearchToKnowledgeBaseEntry, transformESToKnowledgeBase } from './transforms';
 import { SECURITY_LABS_RESOURCE, USER_RESOURCE } from '../../routes/knowledge_base/constants';
 import {
   getKBVectorSearchQuery,
   getStructuredToolForIndexEntry,
   isModelAlreadyExistsError,
 } from './helpers';
-import { getKBUserFilter } from '../../routes/knowledge_base/entries/utils';
+import {
+  getKBUserFilter,
+  validateDocumentsModification,
+} from '../../routes/knowledge_base/entries/utils';
 import {
   loadSecurityLabs,
   getSecurityLabsDocsCount,
 } from '../../lib/langchain/content_loaders/security_labs_loader';
 import { ASSISTANT_ELSER_INFERENCE_ID } from './field_maps_configuration';
+import { BulkOperationError } from '../../lib/data_stream/documents_data_writer';
+import { AUDIT_OUTCOME, KnowledgeBaseAuditAction, knowledgeBaseAuditEvent } from './audit_events';
 
 /**
  * Params for when creating KbDataClient in Request Context Factory. Useful if needing to modify
@@ -633,6 +649,118 @@ export class AIAssistantKnowledgeBaseDataClient extends AIAssistantDataClient {
     });
   };
 
+  /**
+   * Updates a Knowledge Base Entry.
+   *
+   * @param auditLogger
+   * @param knowledgeBaseEntryId
+   */
+  public updateKnowledgeBaseEntry = async ({
+    auditLogger,
+    knowledgeBaseEntry,
+  }: {
+    auditLogger?: AuditLogger;
+    knowledgeBaseEntry: KnowledgeBaseEntryUpdateProps;
+  }): Promise<{
+    errors: BulkOperationError[];
+    updatedEntry: KnowledgeBaseEntryResponse;
+  }> => {
+    const authenticatedUser = this.options.currentUser;
+
+    if (authenticatedUser == null) {
+      throw new Error(
+        'Authenticated user not found! Ensure kbDataClient was initialized from a request.'
+      );
+    }
+
+    await validateDocumentsModification(this, authenticatedUser, [knowledgeBaseEntry.id], 'update');
+
+    this.options.logger.debug(
+      () => `Updating Knowledge Base Entry:\n ${JSON.stringify(knowledgeBaseEntry, null, 2)}`
+    );
+    this.options.logger.debug(`kbIndex: ${this.indexTemplateAndPattern.alias}`);
+
+    const writer = await this.getWriter();
+    const changedAt = new Date().toISOString();
+    const { errors, docs_updated: docsUpdated } = await writer.bulk({
+      documentsToUpdate: [
+        transformToUpdateSchema({
+          user: authenticatedUser,
+          updatedAt: changedAt,
+          entry: knowledgeBaseEntry,
+          global: knowledgeBaseEntry.users != null && knowledgeBaseEntry.users.length === 0,
+        }),
+      ],
+      getUpdateScript: (entry: UpdateKnowledgeBaseEntrySchema) => getUpdateScript({ entry }),
+      authenticatedUser,
+    });
+
+    // @ts-ignore-next-line TS2322
+    const updatedEntry = transformESToKnowledgeBase(docsUpdated)?.[0];
+
+    if (updatedEntry) {
+      auditLogger?.log(
+        knowledgeBaseAuditEvent({
+          action: KnowledgeBaseAuditAction.UPDATE,
+          id: updatedEntry.id,
+          name: updatedEntry.name,
+          outcome: AUDIT_OUTCOME.SUCCESS,
+        })
+      );
+    }
+
+    return { errors, updatedEntry };
+  };
+
+  /**
+   * Deletes a new Knowledge Base Entry.
+   *
+   * @param auditLogger
+   * @param knowledgeBaseEntryId
+   */
+  public deleteKnowledgeBaseEntry = async ({
+    auditLogger,
+    knowledgeBaseEntryId,
+  }: {
+    auditLogger?: AuditLogger;
+    knowledgeBaseEntryId: string;
+  }): Promise<{ errors: BulkOperationError[]; docsDeleted: string[] } | null> => {
+    const authenticatedUser = this.options.currentUser;
+
+    if (authenticatedUser == null) {
+      throw new Error(
+        'Authenticated user not found! Ensure kbDataClient was initialized from a request.'
+      );
+    }
+
+    await validateDocumentsModification(this, authenticatedUser, [knowledgeBaseEntryId], 'delete');
+
+    this.options.logger.debug(
+      () => `Deleting Knowledge Base Entry:\n ID: ${JSON.stringify(knowledgeBaseEntryId, null, 2)}`
+    );
+    this.options.logger.debug(`kbIndex: ${this.indexTemplateAndPattern.alias}`);
+
+    const writer = await this.getWriter();
+    const { errors, docs_deleted: docsDeleted } = await writer.bulk({
+      documentsToDelete: [knowledgeBaseEntryId],
+      authenticatedUser,
+    });
+
+    if (docsDeleted.length) {
+      docsDeleted.forEach((docsDeletedId) => {
+        auditLogger?.log(
+          knowledgeBaseAuditEvent({
+            action: KnowledgeBaseAuditAction.DELETE,
+            id: docsDeletedId,
+            outcome: AUDIT_OUTCOME.SUCCESS,
+          })
+        );
+      });
+    }
+
+    return { errors, docsDeleted };
+  };
+
   /**
    * Returns AssistantTools for any 'relevant' KB IndexEntries that exist in the knowledge base.
    *

x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/get/get_attack_discovery.ts

@@ -9,7 +9,7 @@ import { buildRouteValidationWithZod } from '@kbn/elastic-assistant-common/impl/
 import { type IKibanaResponse, IRouter, Logger } from '@kbn/core/server';
 import {
   AttackDiscoveryGetResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   AttackDiscoveryGetRequestParams,
 } from '@kbn/elastic-assistant-common';
 import { transformError } from '@kbn/securitysolution-es-utils';
@@ -32,7 +32,7 @@ export const getAttackDiscoveryRoute = (router: IRouter<ElasticAssistantRequestH
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             params: buildRouteValidationWithZod(AttackDiscoveryGetRequestParams),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/cancel/cancel_attack_discovery.ts

@@ -9,7 +9,7 @@ import { buildRouteValidationWithZod } from '@kbn/elastic-assistant-common/impl/
 import { type IKibanaResponse, IRouter, Logger } from '@kbn/core/server';
 import {
   AttackDiscoveryCancelResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   AttackDiscoveryCancelRequestParams,
 } from '@kbn/elastic-assistant-common';
 import { transformError } from '@kbn/securitysolution-es-utils';
@@ -34,7 +34,7 @@ export const cancelAttackDiscoveryRoute = (
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             params: buildRouteValidationWithZod(AttackDiscoveryCancelRequestParams),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/post_attack_discovery.ts

@@ -9,7 +9,7 @@ import { type IKibanaResponse, IRouter, Logger } from '@kbn/core/server';
 import {
   AttackDiscoveryPostRequestBody,
   AttackDiscoveryPostResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   Replacements,
 } from '@kbn/elastic-assistant-common';
 import { buildRouteValidationWithZod } from '@kbn/elastic-assistant-common/impl/schemas/common';
@@ -48,7 +48,7 @@ export const postAttackDiscoveryRoute = (
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             body: buildRouteValidationWithZod(AttackDiscoveryPostRequestBody),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/get_defend_insight.ts

@@ -13,7 +13,7 @@ import {
   DEFEND_INSIGHTS_BY_ID,
   DefendInsightGetResponse,
   DefendInsightGetRequestParams,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
 } from '@kbn/elastic-assistant-common';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
@@ -34,7 +34,7 @@ export const getDefendInsightRoute = (router: IRouter<ElasticAssistantRequestHan
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             params: buildRouteValidationWithZod(DefendInsightGetRequestParams),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/get_defend_insights.ts

@@ -13,7 +13,7 @@ import {
   DEFEND_INSIGHTS,
   DefendInsightsGetResponse,
   DefendInsightsGetRequestQuery,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
 } from '@kbn/elastic-assistant-common';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
@@ -34,7 +34,7 @@ export const getDefendInsightsRoute = (router: IRouter<ElasticAssistantRequestHa
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             query: buildRouteValidationWithZod(DefendInsightsGetRequestQuery),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/post_defend_insights.ts

@@ -14,7 +14,7 @@ import {
   DEFEND_INSIGHTS,
   DefendInsightsPostRequestBody,
   DefendInsightsPostResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   Replacements,
 } from '@kbn/elastic-assistant-common';
 import { transformError } from '@kbn/securitysolution-es-utils';
@@ -54,7 +54,7 @@ export const postDefendInsightsRoute = (router: IRouter<ElasticAssistantRequestH
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: {
           request: {
             body: buildRouteValidationWithZod(DefendInsightsPostRequestBody),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/bulk_actions_route.ts

@@ -48,7 +48,7 @@ import {
   transformToCreateSchema,
   transformToUpdateSchema,
 } from '../../../ai_assistant_data_clients/knowledge_base/create_knowledge_base_entry';
-import { getKBUserFilter } from './utils';
+import { validateDocumentsModification } from './utils';
 
 export interface BulkOperationError {
   message: string;
@@ -167,7 +167,7 @@ const buildBulkResponse = (
 export const bulkActionKnowledgeBaseEntriesRoute = (router: ElasticAssistantPluginRouter) => {
   router.versioned
     .post({
-      access: 'internal',
+      access: 'public',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
       security: {
         authz: {
@@ -182,7 +182,7 @@ export const bulkActionKnowledgeBaseEntriesRoute = (router: ElasticAssistantPlug
     })
     .addVersion(
       {
-        version: API_VERSIONS.internal.v1,
+        version: API_VERSIONS.public.v1,
         validate: {
           request: {
             body: buildRouteValidationWithZod(PerformKnowledgeBaseEntryBulkActionRequestBody),
@@ -235,7 +235,6 @@ export const bulkActionKnowledgeBaseEntriesRoute = (router: ElasticAssistantPlug
           const kbDataClient = await ctx.elasticAssistant.getAIAssistantKnowledgeBaseDataClient();
           const spaceId = ctx.elasticAssistant.getSpaceId();
           const authenticatedUser = checkResponse.currentUser;
-          const userFilter = getKBUserFilter(authenticatedUser);
           const manageGlobalKnowledgeBaseAIAssistant =
             kbDataClient?.options.manageGlobalKnowledgeBaseAIAssistant;
 
@@ -266,39 +265,15 @@ export const bulkActionKnowledgeBaseEntriesRoute = (router: ElasticAssistantPlug
             }
           }
 
-          const validateDocumentsModification = async (
-            documentIds: string[],
-            operation: 'delete' | 'update'
-          ) => {
-            if (!documentIds.length) {
-              return;
-            }
-            const documentsFilter = documentIds.map((id) => `_id:${id}`).join(' OR ');
-            const entries = await kbDataClient?.findDocuments<EsKnowledgeBaseEntrySchema>({
-              page: 1,
-              perPage: 100,
-              filter: `${documentsFilter} AND ${userFilter}`,
-            });
-            const availableEntries = entries
-              ? transformESSearchToKnowledgeBaseEntry(entries.data)
-              : [];
-            availableEntries.forEach((entry) => {
-              // RBAC validation
-              const isGlobal = entry.users != null && entry.users.length === 0;
-              if (isGlobal && !manageGlobalKnowledgeBaseAIAssistant) {
-                throw new Error(
-                  `User lacks privileges to ${operation} global knowledge base entries`
-                );
-              }
-            });
-            const availableIds = availableEntries.map((doc) => doc.id);
-            const nonAvailableIds = documentIds.filter((id) => !availableIds.includes(id));
-            if (nonAvailableIds.length > 0) {
-              throw new Error(`Could not find documents to ${operation}: ${nonAvailableIds}.`);
-            }
-          };
-          await validateDocumentsModification(body.delete?.ids ?? [], 'delete');
           await validateDocumentsModification(
+            kbDataClient,
+            authenticatedUser,
+            body.delete?.ids ?? [],
+            'delete'
+          );
+          await validateDocumentsModification(
+            kbDataClient,
+            authenticatedUser,
             body.update?.map((entry) => entry.id) ?? [],
             'update'
           );

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/create_route.ts

@@ -23,7 +23,7 @@ import { performChecks } from '../../helpers';
 export const createKnowledgeBaseEntryRoute = (router: ElasticAssistantPluginRouter): void => {
   router.versioned
     .post({
-      access: 'internal',
+      access: 'public',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
 
       security: {
@@ -34,7 +34,7 @@ export const createKnowledgeBaseEntryRoute = (router: ElasticAssistantPluginRout
     })
     .addVersion(
       {
-        version: API_VERSIONS.internal.v1,
+        version: API_VERSIONS.public.v1,
         validate: {
           request: {
             body: buildRouteValidationWithZod(KnowledgeBaseEntryCreateProps),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/delete_route.test.ts

@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
+import { requestContextMock } from '../../../__mocks__/request_context';
+import { serverMock } from '../../../__mocks__/server';
+import { deleteKnowledgeBaseEntryRoute } from './delete_route';
+import { getBasicEmptySearchResponse, getEmptyFindResult } from '../../../__mocks__/response';
+import { getDeleteKnowledgeBaseEntryRequest, requestMock } from '../../../__mocks__/request';
+import { authenticatedUser } from '../../../__mocks__/user';
+import { ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID } from '@kbn/elastic-assistant-common';
+
+describe('Delete knowledge base entry route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { clients, context } = requestContextMock.createTools();
+  const mockUser1 = authenticatedUser;
+
+  beforeEach(() => {
+    server = serverMock.create();
+    ({ clients, context } = requestContextMock.createTools());
+
+    clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.findDocuments.mockResolvedValue(
+      Promise.resolve(getEmptyFindResult())
+    ); // no current conversations
+    clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.deleteKnowledgeBaseEntry.mockResolvedValue(
+      { errors: [], docsDeleted: ['04128c15-0d1b-4716-a4c5-46997ac7f3bd'] }
+    ); // creation succeeds
+
+    context.core.elasticsearch.client.asCurrentUser.search.mockResolvedValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise(getBasicEmptySearchResponse())
+    );
+    context.elasticAssistant.getCurrentUser.mockReturnValue(mockUser1);
+    deleteKnowledgeBaseEntryRoute(server.router);
+  });
+
+  describe('status codes', () => {
+    test('returns 200 with a conversation deleted via AIAssistantKnowledgeBaseDataClient', async () => {
+      const response = await server.inject(
+        getDeleteKnowledgeBaseEntryRequest({ id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd' }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(200);
+    });
+
+    test('returns 401 Unauthorized when request context getCurrentUser is not defined', async () => {
+      context.elasticAssistant.getCurrentUser.mockReturnValueOnce(null);
+      const response = await server.inject(
+        getDeleteKnowledgeBaseEntryRequest({ id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd' }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(401);
+    });
+  });
+
+  describe('unhappy paths', () => {
+    test('catches error if deletion throws', async () => {
+      clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.deleteKnowledgeBaseEntry.mockImplementation(
+        async () => {
+          throw new Error('Test error');
+        }
+      );
+      const response = await server.inject(
+        getDeleteKnowledgeBaseEntryRequest({ id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd' }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(500);
+      expect(response.body).toEqual({
+        message: 'Test error',
+        status_code: 500,
+      });
+    });
+  });
+
+  describe('request validation', () => {
+    test('disallows wrong name type', async () => {
+      const request = requestMock.create({
+        method: 'delete',
+        path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID,
+        params: {
+          id: '',
+        },
+      });
+      const result = server.validate(request);
+
+      expect(result.badRequest).toHaveBeenCalled();
+    });
+  });
+});

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/delete_route.ts

@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IKibanaResponse } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+import {
+  API_VERSIONS,
+  ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+} from '@kbn/elastic-assistant-common';
+import { buildRouteValidationWithZod } from '@kbn/elastic-assistant-common/impl/schemas/common';
+import {
+  DeleteKnowledgeBaseEntryRequestParams,
+  DeleteKnowledgeBaseEntryResponse,
+} from '@kbn/elastic-assistant-common/impl/schemas/knowledge_base/entries/crud_knowledge_base_entries_route.gen';
+import { ElasticAssistantPluginRouter } from '../../../types';
+import { buildResponse } from '../../utils';
+import { performChecks } from '../../helpers';
+
+export const deleteKnowledgeBaseEntryRoute = (router: ElasticAssistantPluginRouter): void => {
+  router.versioned
+    .delete({
+      access: 'public',
+      path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
+    })
+    .addVersion(
+      {
+        version: API_VERSIONS.public.v1,
+        validate: {
+          request: {
+            params: buildRouteValidationWithZod(DeleteKnowledgeBaseEntryRequestParams),
+          },
+        },
+      },
+      async (
+        context,
+        request,
+        response
+      ): Promise<IKibanaResponse<DeleteKnowledgeBaseEntryResponse>> => {
+        const assistantResponse = buildResponse(response);
+        try {
+          const ctx = await context.resolve(['core', 'elasticAssistant', 'licensing']);
+          const logger = ctx.elasticAssistant.logger;
+
+          // Perform license, authenticated user and FF checks
+          const checkResponse = performChecks({
+            context: ctx,
+            request,
+            response,
+          });
+          if (!checkResponse.isSuccess) {
+            return checkResponse.response;
+          }
+
+          logger.debug(() => `Deleting KB Entry:\n${JSON.stringify(request.body)}`);
+
+          const kbDataClient = await ctx.elasticAssistant.getAIAssistantKnowledgeBaseDataClient();
+          const deleteResponse = await kbDataClient?.deleteKnowledgeBaseEntry({
+            knowledgeBaseEntryId: request.params.id,
+            auditLogger: ctx.elasticAssistant.auditLogger,
+          });
+
+          if (deleteResponse?.docsDeleted) {
+            return response.ok({
+              body: {
+                id: deleteResponse?.docsDeleted[0],
+              },
+            });
+          }
+
+          return assistantResponse.error({
+            body: deleteResponse?.errors?.[0].message ?? `Knowledge Base Entry was not deleted`,
+            statusCode: 400,
+          });
+        } catch (err) {
+          const error = transformError(err as Error);
+          return assistantResponse.error({
+            body: error.message,
+            statusCode: error.statusCode,
+          });
+        }
+      }
+    );
+};

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/find_route.ts

@@ -31,7 +31,7 @@ import { SECURITY_LABS_RESOURCE } from '../constants';
 export const findKnowledgeBaseEntriesRoute = (router: ElasticAssistantPluginRouter) => {
   router.versioned
     .get({
-      access: 'internal',
+      access: 'public',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
       security: {
         authz: {
@@ -41,7 +41,7 @@ export const findKnowledgeBaseEntriesRoute = (router: ElasticAssistantPluginRout
     })
     .addVersion(
       {
-        version: API_VERSIONS.internal.v1,
+        version: API_VERSIONS.public.v1,
         validate: {
           request: {
             query: buildRouteValidationWithZod(FindKnowledgeBaseEntriesRequestQuery),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/update_route.test.ts

@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
+import { requestContextMock } from '../../../__mocks__/request_context';
+import { serverMock } from '../../../__mocks__/server';
+import { updateKnowledgeBaseEntryRoute } from './update_route';
+import {
+  getBasicEmptySearchResponse,
+  getEmptyFindResult,
+  getFindKnowledgeBaseEntriesResultWithSingleHit,
+} from '../../../__mocks__/response';
+import { getUpdateKnowledgeBaseEntryRequest, requestMock } from '../../../__mocks__/request';
+import {
+  getKnowledgeBaseEntryMock,
+  getQueryKnowledgeBaseEntryParams,
+  getUpdateKnowledgeBaseEntrySchemaMock,
+} from '../../../__mocks__/knowledge_base_entry_schema.mock';
+import { authenticatedUser } from '../../../__mocks__/user';
+import { ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL } from '@kbn/elastic-assistant-common';
+
+describe('Update knowledge base entry route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { clients, context } = requestContextMock.createTools();
+  const mockUser1 = authenticatedUser;
+
+  beforeEach(() => {
+    server = serverMock.create();
+    ({ clients, context } = requestContextMock.createTools());
+
+    clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.findDocuments.mockResolvedValue(
+      Promise.resolve(getEmptyFindResult())
+    ); // no current conversations
+    clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.updateKnowledgeBaseEntry.mockResolvedValue(
+      {
+        errors: [],
+        updatedEntry: getKnowledgeBaseEntryMock(getQueryKnowledgeBaseEntryParams(true)),
+      }
+    ); // creation succeeds
+
+    context.core.elasticsearch.client.asCurrentUser.search.mockResolvedValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise(getBasicEmptySearchResponse())
+    );
+    context.elasticAssistant.getCurrentUser.mockReturnValue(mockUser1);
+    updateKnowledgeBaseEntryRoute(server.router);
+  });
+
+  describe('status codes', () => {
+    test('returns 200 with a conversation updated via AIAssistantKnowledgeBaseDataClient', async () => {
+      clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.findDocuments.mockResolvedValue(
+        Promise.resolve(getFindKnowledgeBaseEntriesResultWithSingleHit())
+      );
+
+      const response = await server.inject(
+        getUpdateKnowledgeBaseEntryRequest({
+          params: { id: '1' },
+          body: getKnowledgeBaseEntryMock(getQueryKnowledgeBaseEntryParams(true)),
+        }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(200);
+    });
+
+    test('returns 401 Unauthorized when request context getCurrentUser is not defined', async () => {
+      context.elasticAssistant.getCurrentUser.mockReturnValueOnce(null);
+      const response = await server.inject(
+        getUpdateKnowledgeBaseEntryRequest({
+          params: { id: '1' },
+          body: getKnowledgeBaseEntryMock(getQueryKnowledgeBaseEntryParams(true)),
+        }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(401);
+    });
+  });
+
+  describe('unhappy paths', () => {
+    test('catches error if update throws', async () => {
+      clients.elasticAssistant.getAIAssistantKnowledgeBaseDataClient.updateKnowledgeBaseEntry.mockImplementation(
+        async () => {
+          throw new Error('Test error');
+        }
+      );
+      const response = await server.inject(
+        getUpdateKnowledgeBaseEntryRequest({
+          params: { id: '1' },
+          body: getKnowledgeBaseEntryMock(getQueryKnowledgeBaseEntryParams(true)),
+        }),
+        requestContextMock.convertContext(context)
+      );
+      expect(response.status).toEqual(500);
+      expect(response.body).toEqual({
+        message: 'Test error',
+        status_code: 500,
+      });
+    });
+  });
+
+  describe('request validation', () => {
+    test('disallows POST request', async () => {
+      const request = requestMock.create({
+        method: 'put',
+        path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL,
+        params: {
+          id: '1',
+        },
+        body: {
+          ...getUpdateKnowledgeBaseEntrySchemaMock(),
+          name: true,
+        },
+      });
+      const result = server.validate(request);
+
+      expect(result.badRequest).toHaveBeenCalled();
+    });
+  });
+});

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/update_route.ts

@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IKibanaResponse } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+import {
+  API_VERSIONS,
+  ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+  UpdateKnowledgeBaseEntryRequestParams,
+} from '@kbn/elastic-assistant-common';
+import { buildRouteValidationWithZod } from '@kbn/elastic-assistant-common/impl/schemas/common';
+import {
+  KnowledgeBaseEntryResponse,
+  KnowledgeBaseEntryUpdateProps,
+} from '@kbn/elastic-assistant-common/impl/schemas/knowledge_base/entries/common_attributes.gen';
+import { ElasticAssistantPluginRouter } from '../../../types';
+import { buildResponse } from '../../utils';
+import { performChecks } from '../../helpers';
+
+export const updateKnowledgeBaseEntryRoute = (router: ElasticAssistantPluginRouter): void => {
+  router.versioned
+    .put({
+      access: 'public',
+      path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BY_ID,
+
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
+    })
+    .addVersion(
+      {
+        version: API_VERSIONS.public.v1,
+        validate: {
+          request: {
+            params: buildRouteValidationWithZod(UpdateKnowledgeBaseEntryRequestParams),
+            body: buildRouteValidationWithZod(KnowledgeBaseEntryUpdateProps),
+          },
+        },
+      },
+      async (context, request, response): Promise<IKibanaResponse<KnowledgeBaseEntryResponse>> => {
+        const assistantResponse = buildResponse(response);
+        try {
+          const ctx = await context.resolve(['core', 'elasticAssistant', 'licensing']);
+          const logger = ctx.elasticAssistant.logger;
+
+          // Perform license, authenticated user and FF checks
+          const checkResponse = performChecks({
+            context: ctx,
+            request,
+            response,
+          });
+          if (!checkResponse.isSuccess) {
+            return checkResponse.response;
+          }
+
+          logger.debug(() => `Updating KB Entry:\n${JSON.stringify(request.body)}`);
+
+          const kbDataClient = await ctx.elasticAssistant.getAIAssistantKnowledgeBaseDataClient();
+          const updateResponse = await kbDataClient?.updateKnowledgeBaseEntry({
+            knowledgeBaseEntry: { ...request.body, id: request.params.id },
+            auditLogger: ctx.elasticAssistant.auditLogger,
+          });
+
+          if (updateResponse?.updatedEntry) {
+            return response.ok({
+              body: updateResponse?.updatedEntry,
+            });
+          }
+
+          return assistantResponse.error({
+            body: updateResponse?.errors?.[0].message ?? `Knowledge Base Entry was not created`,
+            statusCode: 400,
+          });
+        } catch (err) {
+          const error = transformError(err as Error);
+          return assistantResponse.error({
+            body: error.message,
+            statusCode: error.statusCode,
+          });
+        }
+      }
+    );
+};

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/entries/utils.ts

@@ -6,6 +6,9 @@
  */
 
 import { AuthenticatedUser } from '@kbn/core-security-common';
+import { AIAssistantKnowledgeBaseDataClient } from '../../../ai_assistant_data_clients/knowledge_base';
+import { transformESSearchToKnowledgeBaseEntry } from '../../../ai_assistant_data_clients/knowledge_base/transforms';
+import { EsKnowledgeBaseEntrySchema } from '../../../ai_assistant_data_clients/knowledge_base/types';
 
 export const getKBUserFilter = (user: AuthenticatedUser | null) => {
   // Only return the current users entries and all other global entries (where user[] is empty)
@@ -24,3 +27,37 @@ export const getKBUserFilter = (user: AuthenticatedUser | null) => {
 
   return `(${globalFilter}${userFilter})`;
 };
+
+export const validateDocumentsModification = async (
+  kbDataClient: AIAssistantKnowledgeBaseDataClient | null,
+  authenticatedUser: AuthenticatedUser | null,
+  documentIds: string[],
+  operation: 'delete' | 'update'
+) => {
+  if (!documentIds.length) {
+    return;
+  }
+  const manageGlobalKnowledgeBaseAIAssistant =
+    kbDataClient?.options?.manageGlobalKnowledgeBaseAIAssistant;
+
+  const userFilter = getKBUserFilter(authenticatedUser);
+  const documentsFilter = documentIds.map((id) => `_id:${id}`).join(' OR ');
+  const entries = await kbDataClient?.findDocuments<EsKnowledgeBaseEntrySchema>({
+    page: 1,
+    perPage: 100,
+    filter: `${documentsFilter} AND ${userFilter}`,
+  });
+  const availableEntries = entries ? transformESSearchToKnowledgeBaseEntry(entries.data) : [];
+  availableEntries.forEach((entry) => {
+    // RBAC validation
+    const isGlobal = entry.users != null && entry.users.length === 0;
+    if (isGlobal && !manageGlobalKnowledgeBaseAIAssistant) {
+      throw new Error(`User lacks privileges to ${operation} global knowledge base entries`);
+    }
+  });
+  const availableIds = availableEntries.map((doc) => doc.id);
+  const nonAvailableIds = documentIds.filter((id) => !availableIds.includes(id));
+  if (nonAvailableIds.length > 0) {
+    throw new Error(`Could not find documents to ${operation}: ${nonAvailableIds}.`);
+  }
+};

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_indices.ts

@@ -8,7 +8,7 @@
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import {
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_INDICES_URL,
   GetKnowledgeBaseIndicesResponse,
 } from '@kbn/elastic-assistant-common';
@@ -36,7 +36,7 @@ export const getKnowledgeBaseIndicesRoute = (router: ElasticAssistantPluginRoute
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         validate: false,
       },
       async (context, _, response): Promise<IKibanaResponse<GetKnowledgeBaseIndicesResponse>> => {

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts

@@ -8,7 +8,7 @@
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import {
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
   ReadKnowledgeBaseRequestParams,
   ReadKnowledgeBaseResponse,
@@ -26,7 +26,7 @@ import { ElasticAssistantPluginRouter } from '../../types';
 export const getKnowledgeBaseStatusRoute = (router: ElasticAssistantPluginRouter) => {
   router.versioned
     .get({
-      access: 'internal',
+      access: 'public',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
       security: {
         authz: {
@@ -36,7 +36,7 @@ export const getKnowledgeBaseStatusRoute = (router: ElasticAssistantPluginRouter
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.public.v1,
         validate: {
           request: {
             params: buildRouteValidationWithZod(ReadKnowledgeBaseRequestParams),

x-pack/solutions/security/plugins/elastic_assistant/server/routes/knowledge_base/post_knowledge_base.ts

@@ -6,7 +6,7 @@
  */
 
 import {
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
   CreateKnowledgeBaseRequestParams,
   CreateKnowledgeBaseResponse,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
@@ -28,7 +28,7 @@ const ROUTE_HANDLER_TIMEOUT = 10 * 60 * 1000; // 10 * 60 seconds = 10 minutes
 export const postKnowledgeBaseRoute = (router: ElasticAssistantPluginRouter) => {
   router.versioned
     .post({
-      access: 'internal',
+      access: 'public',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
       security: {
         authz: {
@@ -43,7 +43,7 @@ export const postKnowledgeBaseRoute = (router: ElasticAssistantPluginRouter) =>
     })
     .addVersion(
       {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.public.v1,
         validate: {
           request: {
             params: buildRouteValidationWithZod(CreateKnowledgeBaseRequestParams),

x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx

@@ -12,10 +12,7 @@ import type {
   GenerationInterval,
   AttackDiscoveryStats,
 } from '@kbn/elastic-assistant-common';
-import {
-  AttackDiscoveryPostResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
-} from '@kbn/elastic-assistant-common';
+import { AttackDiscoveryPostResponse, API_VERSIONS } from '@kbn/elastic-assistant-common';
 import { isEmpty } from 'lodash/fp';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import { useFetchAnonymizationFields } from '@kbn/elastic-assistant/impl/assistant/api/anonymization_fields/use_fetch_anonymization_fields';
@@ -193,7 +190,7 @@ export const useAttackDiscovery = ({
         // call the internal API to generate attack discoveries:
         const rawResponse = await http.post('/internal/elastic_assistant/attack_discovery', {
           body: JSON.stringify(bodyWithOverrides),
-          version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+          version: API_VERSIONS.internal.v1,
         });
         setIsLoadingPost(false);
         const parsedResponse = AttackDiscoveryPostResponse.safeParse(rawResponse);

x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/use_poll_api/use_poll_api.tsx

@@ -15,7 +15,7 @@ import type {
 import {
   AttackDiscoveryCancelResponse,
   AttackDiscoveryGetResponse,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+  API_VERSIONS,
 } from '@kbn/elastic-assistant-common';
 import type { HttpSetup } from '@kbn/core-http-browser';
 import moment from 'moment';
@@ -126,7 +126,7 @@ export const usePollApi = ({
         `/internal/elastic_assistant/attack_discovery/cancel/${connectorId}`,
         {
           method: 'POST',
-          version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+          version: API_VERSIONS.internal.v1,
         }
       );
       const parsedResponse = AttackDiscoveryCancelResponse.safeParse(rawResponse);
@@ -159,7 +159,7 @@ export const usePollApi = ({
         `/internal/elastic_assistant/attack_discovery/${connectorId}`,
         {
           method: 'GET',
-          version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+          version: API_VERSIONS.internal.v1,
         }
       );
 

x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/insights/use_fetch_insights.ts

@@ -6,7 +6,7 @@
  */
 
 import { useQuery } from '@tanstack/react-query';
-import { ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION } from '@kbn/elastic-assistant-common';
+import { API_VERSIONS } from '@kbn/elastic-assistant-common';
 import { WORKFLOW_INSIGHTS } from '../../translations';
 import type { SecurityWorkflowInsight } from '../../../../../../../common/endpoint/types/workflow_insights';
 import { ActionType } from '../../../../../../../common/endpoint/types/workflow_insights';
@@ -27,7 +27,7 @@ export const useFetchInsights = ({ endpointId, onSuccess }: UseFetchInsightsConf
     async () => {
       try {
         const result = await http.get<SecurityWorkflowInsight[]>(WORKFLOW_INSIGHTS_ROUTE, {
-          version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+          version: API_VERSIONS.internal.v1,
           query: {
             actionTypes: JSON.stringify([ActionType.Refreshed]),
             targetIds: JSON.stringify([endpointId]),

x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/insights/use_fetch_ongoing_tasks.ts

@@ -6,10 +6,10 @@
  */
 import { useQuery } from '@tanstack/react-query';
 import {
+  API_VERSIONS,
   DEFEND_INSIGHTS,
   type DefendInsightsResponse,
   DefendInsightStatusEnum,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
 } from '@kbn/elastic-assistant-common';
 import { useEffect, useRef } from 'react';
 import { WORKFLOW_INSIGHTS } from '../../translations';
@@ -45,7 +45,7 @@ export const useFetchOngoingScans = ({
     async () => {
       try {
         const response = await http.get<{ data: DefendInsightsResponse[] }>(DEFEND_INSIGHTS, {
-          version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+          version: API_VERSIONS.internal.v1,
           query: {
             status: DefendInsightStatusEnum.running,
             endpoint_ids: [endpointId],

x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/insights/use_trigger_scan.ts

@@ -8,9 +8,9 @@
 import { useMutation } from '@tanstack/react-query';
 import type { DefendInsightsResponse } from '@kbn/elastic-assistant-common';
 import {
+  API_VERSIONS,
   DEFEND_INSIGHTS,
   DefendInsightTypeEnum,
-  ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
 } from '@kbn/elastic-assistant-common';
 import { useFetchAnonymizationFields } from '@kbn/elastic-assistant/impl/assistant/api/anonymization_fields/use_fetch_anonymization_fields';
 import { useKibana, useToasts } from '../../../../../../common/lib/kibana';
@@ -36,7 +36,7 @@ export const useTriggerScan = ({ onMutate, onSuccess }: UseTriggerScanConfig) =>
   return useMutation<DefendInsightsResponse, { body?: { error: string } }, UseTriggerScanPayload>(
     ({ endpointId, connectorId, actionTypeId }: UseTriggerScanPayload) =>
       http.post<DefendInsightsResponse>(DEFEND_INSIGHTS, {
-        version: ELASTIC_AI_ASSISTANT_INTERNAL_API_VERSION,
+        version: API_VERSIONS.internal.v1,
         body: JSON.stringify({
           endpointIds: [endpointId],
           insightType: DefendInsightTypeEnum.incompatible_antivirus,

x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/utils/bulk_actions_entry.ts

@@ -10,6 +10,7 @@ import type { ToolingLog } from '@kbn/tooling-log';
 import type SuperTest from 'supertest';
 import {
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
+  API_VERSIONS,
   KnowledgeBaseEntryCreateProps,
   KnowledgeBaseEntryUpdateProps,
   PerformKnowledgeBaseEntryBulkActionResponse,
@@ -50,7 +51,7 @@ export const bulkActionKnowledgeBaseEntries = async ({
   const response = await supertest
     .post(route)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send(payload)
     .expect(expectedHttpCode);
 
@@ -93,7 +94,7 @@ export const bulkActionKnowledgeBaseEntriesForUser = async ({
     .post(route)
     .auth(user.username, user.password)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send(payload)
     .expect(expectedHttpCode);
 

x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/utils/create_entry.ts

@@ -9,6 +9,7 @@ import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
 import type { ToolingLog } from '@kbn/tooling-log';
 import type SuperTest from 'supertest';
 import {
+  API_VERSIONS,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
   KnowledgeBaseEntryCreateProps,
   KnowledgeBaseEntryResponse,
@@ -42,7 +43,7 @@ export const createEntry = async ({
   const response = await supertest
     .post(route)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send(entry)
     .expect(expectedHttpCode);
 
@@ -78,7 +79,7 @@ export const createEntryForUser = async ({
     .post(route)
     .auth(user.username, user.password)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send(entry)
     .expect(expectedHttpCode);
 

x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/utils/find_entry.ts

@@ -12,6 +12,7 @@ import {
   FindKnowledgeBaseEntriesResponse,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
   FindKnowledgeBaseEntriesRequestQuery,
+  API_VERSIONS,
 } from '@kbn/elastic-assistant-common';
 import type { User } from './auth/types';
 
@@ -39,7 +40,7 @@ export const findEntries = async ({
   const response = await supertest
     .get(route)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send();
   if (response.status !== 200) {
     throw new Error(
@@ -78,7 +79,7 @@ export const findEntriesForUser = async ({
     .get(route)
     .auth(user.username, user.password)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send();
   if (response.status !== 200) {
     throw new Error(

x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/utils/helpers.ts

@@ -7,6 +7,7 @@
 
 import { Client } from '@elastic/elasticsearch';
 import {
+  API_VERSIONS,
   CreateKnowledgeBaseResponse,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_INDICES_URL,
   ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
@@ -73,7 +74,7 @@ export const setupKnowledgeBase = async (
   const response = await supertest
     .post(route)
     .set('kbn-xsrf', 'true')
-    .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+    .set(ELASTIC_HTTP_VERSION_HEADER, API_VERSIONS.public.v1)
     .send();
   if (response.status !== 200) {
     throw new Error(