-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Kibana Fleet API docs need improvement #190402
Comments
Pinging @elastic/fleet (Feature:Fleet) |
Pinging @elastic/fleet (Team:Fleet) |
Hi @nerophon, thanks for opening this issue. There's a few things to make clear for context here:
I am in full agreement that some more context around Fleet's APIs would be helpful, and I do think some "recipe" style documentation with common use cases would be a great way to improve the documentation here.
Is this a problem that is best solved by API documentation, or by higher level explanations of Fleet's data models, relationships, etc? I'm wondering if we should solve this problem at a higher level instead of sort of building a better mental model around Fleet's data model starting at its REST API.
Improving description is an obvious win here, and this will be top of mind as we get started on #184685 above. This will also become more urgent as our new implementation of hosted API docs is rolled out. Serverless API docs are already in the process of being moved over to a new tool that's not publicly shareable yet. Check out some of the recent documentation team update emails for some more info. |
## Summary Closes #155550 Relates #190402 Users have reported unclear expectations from [Fleet Enrollment API Keys API](https://www.elastic.co/guide/en/fleet/current/fleet-apis.html#EnrollmentAPIKeys). These include: - Enrollment token names must be unique (impacts token creation). - Deleting an enrollment token doesn't actually delete, it revokes (invalidates it, marks it as inactive). - Revoked tokens are still returned (with `"active": false`) by `GET /api/fleet/enrollment_api_keys`. - It's not clear what happens to the API key after it's been invalidated. This PR adds some details to the OpenAPI spec. I believe, however, that some improvements could also be brought to the documentation itself in order to fully address the above concerns. The [Fleet enrollment tokens](https://www.elastic.co/guide/en/fleet/8.15/fleet-enrollment-tokens.html) doc page already describes enrollment token creation and deletion, perhaps the following information could be added: - Why the token name must be unique. - Add an explanation around revoking tokens (marked as inactive, will be removed after expiration) with a link to the [retention period setting in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html#api-key-service-settings-delete-retention-period). - A mention that inactive tokens are still returned by the GET API and visible in the UI until they are cleaned up. A final note around the variations in terminology (not a big issue, I think): - "enrollment tokens" in the docs vs. "enrollment API keys" in the OpenAPI spec (I thought it would be best to keep the latter consistent) - "[revoke token](https://www.elastic.co/guide/en/fleet/8.15/fleet-enrollment-tokens.html#revoke-fleet-enrollment-tokens)" vs. "[invalidate API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-invalidate-api-key.html)" --------- Co-authored-by: Elastic Machine <[email protected]>
Kibana version: 8.14
The documentation of the Kibana Fleet API needs significant improvement. There is an introduction here:
https://www.elastic.co/guide/en/fleet/current/fleet-apis.html
Then the API can be viewed in various ways, two examples:
https://www.elastic.co/guide/en/fleet/current/fleet-apis.html
https://petstore.swagger.io/?url=https://raw.githubusercontent.com/elastic/kibana/master/x-pack/plugins/fleet/common/openapi/bundled.json#/
What this documentation lacks is any explanation or context around why they may be used, and what they are useful for. Starting from a user's perspective, we may for example wish to query which integration packages are presently installed, and if necessary install them. But nowhere is there an explanation of which series of APIs would be required to be called to achieve that.
Arguably, use-cases could be deduced if the descriptions of the APIs were thorough; but instead they are threadbare, generally providing no further information than the name of the API itself suggests. What is needed is a full explanation of the concepts involved, how these APIs interact, and much fuller descriptions of each call.
The text was updated successfully, but these errors were encountered: