Unable to create private location

Elastic Stack Elastic Agent
1

Invalid spaces. Private location spaces [default] must be fully contained within agent policy 532963e5-1c04-4475-b0a3-0d807c6a12e7 spaces [].

GET kbn:/api/fleet/agent_policies/532963e5-1c04-4475-b0a3-0d807c6a12e7

{

"item": {

"id": "532963e5-1c04-4475-b0a3-0d807c6a12e7",

"version": "WzE2OTIyLDY0XQ==",

"created_at": "2026-06-12T19:00:00.169Z",

"space_ids": [],

"description": "Private Location Agent Policy",

"monitoring_enabled": [

"logs",

"metrics"

\],

"inactivity_timeout": 1209600,

"schema_version": "1.1.1",

"package_policies": [],

"agents": 0,

"name": "Priv Location Agent Policy",

"namespace": "default",

"status": "active",

"is_managed": false,

2

Same issue here on self-managed ECK 9.4.2.

We’re trying to use Synthetics private locations for internal HTTPS / certificate monitoring. My understanding is that this should be possible without Fleet Space Awareness / Enterprise, because we only need a private location on our own Elastic Agent in the default space.

We have:

  • Fleet Server running

  • Elastic Agent enrolled and online

  • Agent assigned to the intended policy

  • Synthetics available in Kibana

The blocker is creating the private location.

Based on the error message, POST /api/private_locations seems to validate that the requested private location's spaces are contained within the selected Fleet agent policy’s space_ids.

The problem is that on our 9.4.2 deployment, newly created Fleet policies don't get useful space_ids.

In the Fleet API they appear as null (effectively []), even when you specify space_ids in the create request.

That seems to match your other thread.

@leandrojmp mentions there that this is expected unless Fleet Space Awareness is enabled. But Fleet Space Awareness requires Enterprise, which we do not have.

That leaves us stuck:

  • Creating a private location with spaces: ["default"] fails with:
Invalid spaces. Private location spaces [default] must be fully contained within agent policy <policy-id> spaces [].
  • Creating a private location with spaces omitted fails with:
options.namespaces cannot be an empty array

The second case also seems to contradict the API docs, which say of the spaces parameter:

If it is not provided, the private location is available in all spaces.

So it looks like private locations may currently be blocked on upgraded, non-space-aware Fleet deployments: the Synthetics API requires space alignment, but the Fleet policy has no usable space_ids, and enabling Fleet Space Awareness is not available on Basic.

Is this expected behaviour in 9.4.2, or a bug/regression in the private location validation for non-space-aware Fleet policies?

Happy to share the exact API payloads, Fleet policy response, Kibana logs etc if useful.

3

Repro steps:

Environment

  • Elasticsearch / Kibana 9.4.2 (self-managed, ECK)
  • Fleet space awareness: not enabled
  • Elasticsearch license: basic
  • Kibana space: default
  • Fleet agent policy with an enrolled, online agent (created for private-location use)

Setup

export KIBANA_URL="https://<kibana-host>"
export KIBANA_USER="<user>"
export KIBANA_PASS="<pass>"
export POLICY_ID="<agent-policy-id>"

1. Fleet policy has no meaningful space_ids

curl -sk -u "${KIBANA_USER}:${KIBANA_PASS}" -H 'kbn-xsrf: true' \
  "${KIBANA_URL}/s/default/api/fleet/agent_policies?perPage=1000" \
  | jq --arg id "$POLICY_ID" '.items[] | select(.id == $id) | {id, name, space_ids, agents, namespace}'

Response:

{
  "id": "<agent-policy-id>",
  "name": "<policy-name>",
  "space_ids": null,
  "agents": 0,
  "namespace": "<namespace>"
}

All other policies on this cluster also return space_ids: null.

2. Create private location - omit spaces (API docs: "available in all spaces")

curl -sk -u "${KIBANA_USER}:${KIBANA_PASS}" \
  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
  -X POST "${KIBANA_URL}/s/default/api/synthetics/private_locations" \
  -d "{\"label\":\"demo-no-spaces\",\"agentPolicyId\":\"${POLICY_ID}\",\"tags\":[\"demo\"]}"

Response - HTTP 500:

{
  "statusCode": 500,
  "error": "Internal Server Error",
  "message": "An internal server error occurred. Check Kibana server logs for details."
}

Kibana log:

Error: options.namespaces cannot be an empty array: Bad Request

3. Create private location - spaces: ["default"]

curl -sk -u "${KIBANA_USER}:${KIBANA_PASS}" \
  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
  -X POST "${KIBANA_URL}/s/default/api/synthetics/private_locations" \
  -d "{\"label\":\"demo-with-spaces\",\"agentPolicyId\":\"${POLICY_ID}\",\"tags\":[\"demo\"],\"spaces\":[\"default\"]}"

Response - HTTP 400:

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid spaces. Private location spaces [default] must be fully contained within agent policy <agent-policy-id> spaces []."
}

4. space_ids in policy create request does not persist

curl -sk -u "${KIBANA_USER}:${KIBANA_PASS}" \
  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
  -X POST "${KIBANA_URL}/s/default/api/fleet/agent_policies" \
  -d '{
    "name": "demo-policy-delete-me",
    "description": "space_ids test",
    "namespace": "default",
    "monitoring_enabled": ["logs", "metrics"],
    "space_ids": ["default"]
  }'

Create response (excerpt):

{
  "item": {
    "id": "<new-policy-id>",
    "name": "demo-policy-delete-me",
    "space_ids": null
  }
}

List after create:

{
  "id": "<new-policy-id>",
  "name": "demo-policy-delete-me",
  "space_ids": null
}

Private location on that new policy - same 400:

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid spaces. Private location spaces [default] must be fully contained within agent policy <new-policy-id> spaces []."
}