---
type: api
title: Create a new monitored user
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-createprivmonuser
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-createprivmonuser
products:
  - Kibana
---

# Create a new monitored user

deprecated

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/entity_analytics/monitoring/users`
- `POST` `/s/{space_id}/api/entity_analytics/monitoring/users`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

**Deprecated in 9.4.0.** Use the Watchlists API instead.

Creates a new privileged user to be monitored by the Privilege Monitoring Engine.

## Request Body

`application/json`

- `entity_analytics_monitoring` (object) — optional
  Entity analytics monitoring configuration for the user
  - `labels` ([] object · max: 100) — optional
    Array of labels associated with the user
    - `field` (string · max: 256) — optional
      The field name for the label
    - `source` (enum) — optional
      The source where this label was created (api, csv, or index_sync)
      Values: `api`, `csv`, `index_sync`
    - `value` (string · max: 256) — optional
      The value of the label
- `user` (object) — optional
  - `name` (string · max: 512) — optional
    The name of the user.

## Response

User created successfully

`application/json`

- `entity_analytics_monitoring` (object)
  - `labels` ([] object)
    - `field` (string · max: 256)
    - `source` (string)
    - `value` (string · max: 256)
- `id` (string · max: 256)
- `labels` (object)
  - `source_ids` ([] string · max: 100)
  - `source_integrations` ([] string · max: 100)
  - `sources` ([] enum  · max: 100)
    Values: `csv`, `index_sync`, `api`
- `user` (object)
  - `is_privileged` (boolean)
    Indicates if the user is privileged.
  - `name` (string · max: 512)
- `@timestamp` (string)
- `event` (object)
  - `@timestamp` (string)
  - `ingested` (string)
## Code Examples

#### Console

```console
POST /api/entity_analytics/monitoring/users
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "user": {
    "name": "john.doe"
  }
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/entity_analytics/monitoring/users" \
  -H "Content-Type: application/json" \
  -d '{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "user": {
    "name": "john.doe"
  }
}'
```

## Response Examples

#### Created monitored user

```json
{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}
```