Update api_endpoints.yml

[jp-cpe]

Related issue: Resolves #51607

Summary

Adds the six custom host vitals endpoints to the API-only user endpoint catalog
(server/api_endpoints/api_endpoints.yml) so they can be granted via granular
API-only user permissions.

These endpoints shipped with custom host vitals in v4.90.0 and are registered on
the normal user router, but were never added to the catalog. As a result they
don't appear in GET /api/v1/fleet/rest_api and can't be assigned to an
API-only user's endpoint allowlist — so a customer building an API-only account
to manage custom host vital values has no way to scope access to them.

What changed

Added the following to api_endpoints.yml (mirroring the REST API docs):

Method	Path	Display name
GET	/api/v1/fleet/custom_host_vitals	List custom host vitals
POST	/api/v1/fleet/custom_host_vitals	Create custom host vital
PATCH	/api/v1/fleet/custom_host_vitals/:id	Update custom host vital
DELETE	/api/v1/fleet/custom_host_vitals/:id	Delete custom host vital
PUT	/api/v1/fleet/hosts/:host_id/custom_host_vitals/:id	Update host's custom host vital value
PUT	/api/v1/fleet/spec/custom_host_vitals	Replace all custom host vitals

Notes

• Follow-up (not in this PR): these endpoints slipped because the "add new
  endpoints to api_endpoints.yml" step is manual and unenforced. Worth a
  separate issue to add CI coverage that fails when a non-blocklisted registered
  route is missing from the catalog.

Checklist for submitter

• Changes file added for user-visible changes in changes/.
• No server routes were changed — these routes already exist; this only makes them
  grantable.
• None of the added endpoints match the catalog security blocklist
  (no user/invite/role endpoints).

Testing

• Covered by existing guard tests (TestValidateAPIEndpoints,
  TestCatalogBlocklist); ran go test ./server/api_endpoints/... locally.

Summary by CodeRabbit

• New Features
  • Added Fleet API support for managing custom host vitals.
  • Added endpoints to list, create, update, and delete custom vitals.
  • Added endpoints to update an individual host’s vital value or replace all custom host vitals.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fb94f3cb-6bab-437c-8df9-c52b9609581a

📥 Commits

Reviewing files that changed from the base of the PR and between 5a3dd6e and cba13d0.

📒 Files selected for processing (1)

• server/api_endpoints/api_endpoints.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

Added six custom host vitals endpoint definitions to the Fleet API endpoint catalog. The definitions cover listing, creating, updating, and deleting custom host vitals, updating a host-specific vital value, and replacing all custom host vitals.

Merge Risk: ⚪ Minimal · up to cba13

This localized catalog-only change exposes existing custom host vitals endpoints for granular API-only permissions without changing route behavior; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title identifies the modified catalog file but does not describe the primary change: adding custom host vitals endpoints for API-only permissions.	Use a specific title such as "Add custom host vitals endpoints to API-only catalog".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes the related issue, scope, endpoint list, rationale, checklist details, and testing results.
Linked Issues check	✅ Passed	The six catalog entries directly satisfy issue #51607 by making the custom host vitals endpoints visible and grantable to API-only users.
Out of Scope Changes check	✅ Passed	The changes are limited to adding the six required endpoint definitions in api_endpoints.yml and contain no unrelated code changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch catalog-custom-host-vitals-endpoints

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.68%. Comparing base (2e686bb) to head (cba13d0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #51608      +/-   ##
==========================================
- Coverage   68.68%   68.68%   -0.01%     
==========================================
  Files        4010     4010              
  Lines      260192   260192              
  Branches    13727    13727              
==========================================
- Hits       178720   178713       -7     
- Misses      65704    65710       +6     
- Partials    15768    15769       +1     

Flag	Coverage Δ
backend	69.63% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.