API Reference

The Setup plugin exposes a REST API under /_plugins/_setup/. All endpoints require authentication.

Settings

Update Settings

Persists configuration settings to the .wazuh-settings index. Currently supports the engine.index_raw_events boolean flag, which controls whether the Engine indexes raw events into the wazuh-events-raw-v5 data stream.

Request

• Method: PUT
• Path: /_plugins/_setup/settings

Request Body

Example Request

curl -sk -u admin:admin -X PUT \
  "https://192.168.56.6:9200/_plugins/_setup/settings" \
  -H 'Content-Type: application/json' \
  -d '{
    "engine": {
      "index_raw_events": true
    }
  }'

Example Response (success)

{
  "message": "Settings updated successfully.",
  "status": 200
}

Example Response (missing field)

{
  "message": "Missing required field: 'engine.index_raw_events'.",
  "status": 400
}

Example Response (invalid type)

{
  "message": "Field 'engine.index_raw_events' must be of type boolean.",
  "status": 400
}

Status Codes

Documentation Maintenance — modifications to the REST API must be reflected in both openapi.yml and this file.