[[osquery-manager-packs-api-create]]
=== Create pack API
++++
<titleabbrev>Create pack</titleabbrev>
++++

.New API Reference
[sidebar]
--
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
--

experimental[] Create packs.


[[osquery-manager-packs-api-create-request]]
==== Request

`POST <kibana host>:<port>/api/osquery/packs`

`POST <kibana host>:<port>/s/<space_id>/api/osquery/packs`


[[osquery-manager-packs-api-create-path-params]]
==== Path parameters

`space_id`::
  (Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.


[[osquery-manager-packs-api-create-body-params]]
==== Request body

`name`:: (Required, string) The pack name.

`description`:: (Optional, string) The pack description.

`enabled`:: (Optional, boolean) Enables the pack.

`policy_ids`:: (Optional, array) A list of agents policy IDs.

`shards`:: (Optional, object) An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

`queries`:: (Required, object) An object of queries.


[[osquery-manager-packs-api-create-request-codes]]
==== Response code

`200`::
    Indicates a successful call.


[[osquery-manager-packs-api-create-example]]
==== Examples

Create a pack:

[source,sh]
--------------------------------------------------
$ curl -X POST api/osquery/packs \
{
  "name": "my_pack",
  "description": "My pack",
  "enabled": true,
  "policy_ids": [
    "my_policy_id",
    "fleet-server-policy"
  ],
  "shards": {
    "my_policy_id": 35,
    "fleet-server-policy": 58
  },
  "queries": {
    "my_query": {
      "query": "SELECT * FROM listening_ports;",
      "interval": 60,
      "timeout": 120,
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        },
        "tags": {
          "value": [
            "tag1",
            "tag2"
          ]
        }
      }
    }
  }
}

--------------------------------------------------
// KIBANA


The API returns the pack object:

[source,sh]
--------------------------------------------------
{
    "data": {...}
}
--------------------------------------------------