From 7dfcb76a022bdd23a33dc3cf46ce7072346371d3 Mon Sep 17 00:00:00 2001
From: Nico <32375741+nulmete@users.noreply.github.com>
Date: Tue, 7 Jul 2026 09:59:12 -0300
Subject: [PATCH] Add POST /reports/run to the API endpoints catalog (#48790)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Relates to #43544

The Fleet MCP server runs multi-host live queries by creating an ad-hoc
campaign via `POST /api/v1/fleet/reports/run`, but that route is missing
from the API endpoints catalog. An api-only user restricted to a
specific endpoint allowlist therefore cannot be granted it and receives
a 403, so multi-host live queries fail under a least-privilege setup.
This adds the route to the catalog so it can be granted; it stays gated
by observer_plus RBAC and does not match any allowlist-bypass blocklist
rule.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added support for an asynchronous live report run endpoint.
* API-only users on restricted allowlists can now be granted access to
run reports.
* **Changes**
* Updated the live report endpoint path and display name to reflect the
async behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 changes/api-endpoints-add-reports-run  | 1 +
 server/api_endpoints/api_endpoints.yml | 3 +++
 2 files changed, 4 insertions(+)
 create mode 100644 changes/api-endpoints-add-reports-run

diff --git a/changes/api-endpoints-add-reports-run b/changes/api-endpoints-add-reports-run
new file mode 100644
index 0000000000..db00e5a910
--- /dev/null
+++ b/changes/api-endpoints-add-reports-run
@@ -0,0 +1 @@
+- Added the asynchronous live query endpoint (`POST /api/v1/fleet/reports/run`) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
diff --git a/server/api_endpoints/api_endpoints.yml b/server/api_endpoints/api_endpoints.yml
index be9d445891..31cd0269c8 100644
--- a/server/api_endpoints/api_endpoints.yml
+++ b/server/api_endpoints/api_endpoints.yml
@@ -403,6 +403,9 @@
 - method: "POST"
   path: "/api/v1/fleet/reports/:id/run"
   display_name: "Run live report"
+- method: "POST"
+  path: "/api/v1/fleet/reports/run"
+  display_name: "Run live report (async)"
 - method: "GET"
   path: "/api/v1/fleet/queries/run"
   display_name: "Run live report"