---
type: api
title: Update an agent's access control list
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-put-agent-builder-agents-id-access-control
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-put-agent-builder-agents-id-access-control
products:
  - Kibana
---

# Update an agent's access control list

Availability:

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/agent_builder/agents/{id}/access_control`
- `PUT` `/s/{space_id}/api/agent_builder/agents/{id}/access_control`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

#### Path Parameters

- `id` (string)
  The unique identifier of the agent whose access control to update.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Replace the per-agent access-control entries. Each entry grants one user a role on this agent. Identify the user by their Kibana user profile uid (`id`). Entries created before profile uids were adopted may use `name` (deprecated) instead. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.

## Request Body

`application/json`

- `entries` ([] object · max: 100) — required
  Access-control entries to apply to the agent. Each entry has a `type` (for example `user`), a `role`, and either an `id` (the principal user profile uid, preferred) or a deprecated `name` (username).
  - `id` (string · min: 1 · max: 1024) — optional
    Stable identifier of the user to grant access to (Kibana user profile uid). Preferred over `name`.
  - `name` (string · min: 1 · max: 1024) — optional
    Case-sensitive Kibana username of the user to grant access to. Still supported, but `id` is preferred for new grants because a username cannot distinguish same-named users across authentication realms.
  - `role` (enum) — required
    Role granted to the principal. Roles are hierarchical: `user` allows viewing, listing, reading, and running the agent; `editor` adds updating the agent configuration; `manager` adds deleting the agent and managing its access control.
    Values: `user`, `editor`, `manager`
  - `type` (enum) — required
    Values: `user`

## Responses

#### `200`

Indicates a successful response

#### `400`

Bad Request — the request body failed validation, or the request targets the built-in Elastic default agent (which cannot have custom access control).

#### `404`

Not Found — no agent with this ID is visible to the caller, or the caller lacks write access. Matches the existing `agentNotFound` shape so unprivileged callers cannot probe for hidden agents.

## Code Examples

#### Console

```console
PUT kbn://api/agent_builder/agents/{id}/access_control
{
  "entries": [
    { "type": "user", "id": "u_alice_profile_uid", "role": "editor" },
    { "type": "user", "id": "u_bob_profile_uid", "role": "user" }
  ]
}
```

#### curl

```curl
curl \
  -X PUT "${KIBANA_URL}/api/agent_builder/agents/{id}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "entries": [
      { "type": "user", "id": "u_alice_profile_uid", "role": "editor" },
      { "type": "user", "id": "u_bob_profile_uid", "role": "user" }
    ]
  }'
```

## Response Examples

#### Update agent access control response

Example response returning the persisted access control after the update.

```json
{
  "access_mode": "private",
  "entries": [
    {
      "added_at": "2026-02-11T10:15:00.000Z",
      "id": "u_alice_profile_uid",
      "role": "editor",
      "type": "user"
    },
    {
      "added_at": "2026-02-11T10:15:00.000Z",
      "id": "u_bob_profile_uid",
      "role": "user",
      "type": "user"
    }
  ]
}
```

#### Access control on default agent response

The built-in Elastic default agent (`elastic-ai-agent`) cannot have custom access control — its access is governed by the platform, not per-agent grants.

```json
{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Bad Request",
  "message": "The default agent (elastic-ai-agent) does not support custom access controls.",
  "statusCode": 400
}
```

#### Too many entries response

Request body exceeds the 100-entry maximum.

```json
{
  "error": "Bad Request",
  "message": "[request body.entries]: array size is [101], but cannot be greater than [100]",
  "statusCode": 400
}
```

#### Agent not found response

```json
{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Agent custom-agent-id not found",
  "statusCode": 404
}
```