Index all API routes maintained by our team

[jasonrhodes]

API route access is changing in V9. The main takeaways are:

• The route path will no longer specify access (i.e. "/api/x" vs "/internal/x" will not have any access effect anymore)
• A route must be tagged with access:{valid_access_string} to specify its intended access
• Any route that isn't tagged with the access: tag will be PRIVATE by default

We will probably need to make changes to various APIs we maintain in order to account for this change in V9. As a first step, we need to index all of the API routes for the areas we maintain, along with their intended access level, and whether or not they already use the access: tag.

Acceptance criteria

• The index below is filled out with all known API routes maintained by our team (@elastic/obs-ux-management-team) as of this issue writing in September 2024. Those areas are currently:
  • SLO (x-pack/plugins/observability_solution/slo)
  • Synthetics (x-pack/plugins/observability_solution/synthetics)
  • Uptime (x-pack/plugins/observability_solution/uptime)
  • Observability alerting (likely has no API routes since those are maintained by the alerting platform)
  • RCA initiative / investigations (x-pack/plugins/observability_solution/investigate_app, x-pack/plugins/observability_solution/investigate)
  • Exploratory View (x-pack/plugins/observability_solution/exploratory_view)
  • Observability plugin (x-pack/plugins/observability_solution/observability) (e.g. annotations?)

API Index

SLO

Route path	Public or private?	Uses access:{access} tag?	Link to docs, if they exist
POST /api/observability/slos	public	✅	docs
POST /internal/observability/slos/_inspect	internal	✅
PUT /api/observability/slos/{id}	public	✅	docs
DELETE /api/observability/slos/{id}	public	✅	docs
GET /api/observability/slos/{id}	public	✅	docs
POST /api/observability/slos/{id}/enable	public	✅	docs
POST /api/observability/slos/{id}/disable	public	✅	docs
POST /api/observability/slos/{id}/_reset	public	✅	docs
GET /api/observability/slos	public	✅	docs
GET /internal/observability/slos/_groups	internal	✅
GET /internal/observability/slos/suggestions	internal	✅
POST /api/observability/slos/_delete_instances	public	❌	docs
GET /api/observability/slos/_definitions	internal	❌
POST /internal/observability/slos/_historical_summary	internal	✅
GET /internal/observability/slos/{id}/_instances	internal	✅
GET /internal/observability/slos/_diagnosis	internal	✅
POST /internal/observability/slos/_health	internal	✅
POST /internal/observability/slos/{id}/_burn_rates	internal	✅
POST /internal/observability/slos/_preview	internal	✅
GET /internal/slo/settings	internal	✅
PUT /internal/slo/settings	internal	✅
GET /internal/observability/slos/overview	internal	✅

Synthetics

Route path	Public or private?	Uses access:{access} tag?	Link to docs, if they exist
GET /api/synthetics/monitors	public	✅	docs
POST /api/synthetics/monitors	public	✅	docs
DELETE /api/synthetics/monitors	public	✅	docs
PUT /api/synthetics/monitors	public	✅	docs
GET /api/synthetics/monitors/{monitorId}	public	✅	docs
POST /api/synthetics/private_locations	public	✅	docs
DELETE /api/synthetics/private_locations	public	✅	docs
GET /api/synthetics/private_locations/{id?}	public	✅	docs
POST /api/synthetics/params	public	✅	docs
DELETE /api/synthetics/params	public	✅	docs
PUT /api/synthetics/params/{id}	public	✅	docs
GET /api/synthetics/params/{id?}	public	✅	docs
GET /api/synthetics/project/{projectName}/monitors	public	✅	docs
PUT /api/synthetics/project/{projectName}/monitors/_bulk_update	public	✅
DELETE /api/synthetics/project/{projectName}/monitors/_bulk_delete	public	✅
GET /api/synthetics/settings	public	✅
PUT /api/synthetics/settings	public	✅
GET /internal/synthetics/service/index_templates	private	✅
GET /internal/uptime/service/locations	private	✅
POST /internal/synthetics/service/monitor/inspect	private	✅
PUT /internal/synthetics/service/enablement	private	✅
DELETE /internal/synthetics/service/enablement	private	✅
POST /internal/synthetics/service/monitors/run_once/{monitorId}	private	✅
POST /internal/synthetics/service/monitors/trigger/{monitorId}	private	✅
GET /internal/synthetics/service/allowed	private	✅
GET /internal/synthetics/service/api_key	private	✅
GET /internal/synthetics/fleet/has_integration_monitors	private	✅
GET /internal/synthetics/overview	private	✅
GET /internal/synthetics/pings	private	✅
GET /internal/synthetics/pings	private	✅
POST /internal/synthetics/overview_trends	private	✅
GET /internal/synthetics/overview_status	private	✅
GET /internal/synthetics/index_size	private	✅
GET /internal/synthetics/agent_policies	private	✅
GET /internal/synthetics/private_locations/monitors	private	✅
GET /internal/synthetics/sync_global_params	private	✅
GET /internal/synthetics/enable_default_alerting	private	✅
PUT /internal/synthetics/enable_default_alerting	private	✅
POST /internal/synthetics/enable_default_alerting	private	✅
GET /internal/synthetics/get_actions_connectors	private	✅
GET /internal/synthetics/get_connector_types	private	✅
GET /internal/synthetics/journey/{checkGroup}	private	✅
GET /internal/synthetics/synthetics/check/success	private	✅
POST /internal/synthetics/journey/screenshot/block	private	✅
GET /internal/synthetics/journeys/failed_steps	private	✅
GET /internal/synthetics/network_events	private	✅
GET /internal/synthetics/journey/screenshot/{checkGroup}/{stepIndex}	private	✅
DELETE /internal/synthetics/monitor/policy/{packagePolicyId}	private	✅
GET /internal/synthetics/monitor/filters	private	✅
GET /internal/synthetics/certs	private	✅
GET /internal/synthetics/suggestions	private	✅

Uptime

Route path	Public or private?	Uses access:{access} tag?	Link to docs, if they exist
GET /api/uptime/settings	public	✅	docs
PUT /api/uptime/settings	public	✅	docs
GET /internal/uptime/index_status	private	✅
GET /internal/uptime/monitor/list	private	✅
GET /internal/uptime/monitor/locations	private	✅
GET /internal/uptime/monitor/duration	private	✅
GET /internal/uptime/monitor/details	private	✅
GET /internal/uptime/monitor/status	private	✅
GET /internal/uptime/network_events	private	✅
GET /internal/uptime/pings	private	✅
GET /internal/uptime/ping/histogram	private	✅
GET /internal/uptime/snapshot/count	private	✅
GET /internal/uptime/synthetics/check/success	private	✅
GET /internal/uptime/journey/{checkGroup}	private	✅
GET /internal/uptime/journeys/failed_steps	private	✅
GET /internal/uptime/journey/screenshot/{checkGroup}/{stepIndex}	private	✅
POST /internal/uptime/journey/screenshot/block	private	✅

RCA initiative

Currently volatile, no need to document for now, nothing here is public.

Exploratory view

No API routes.

Observability plugin

Route path	Public or private?	Uses access:{access} tag?	Link to docs, if they exist
POST /api/observability/annotation	public	❌
PUT /api/observability/annotation/{id}	public	❌
DELETE /api/observability/annotation/{id}	public	❌
GET /api/observability/annotation/{id}	public	❌
GET /api/observability/annotation/find	public	❌
GET /api/observability/annotation/permissions	public	❌
GET /internal/observability/assistant/alert_details_contextual_insights	private	❌
GET /api/observability/rules/alerts/dynamic_index_pattern	public	❌

[jasonrhodes]

Thanks all, for putting this together!