---
type: api
title: Bulk update entities
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-put-security-entity-store-entities-bulk
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-put-security-entity-store-entities-bulk
products:
- Kibana
---
# Bulk update entities
- Server: `https://{kibana_url}`
## Paths
- `PUT` `/api/security/entity_store/entities/bulk`
- `PUT` `/s/{space_id}/api/security/entity_store/entities/bulk`
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)
## Description
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update multiple entity records in the Entity Store in a single request.
[Required authorization] Route required privileges: securitySolution.
## Query String Parameters
- `force` (union enum | boolean · default: false)
When true, allows updating protected fields.
Values: `true`, `false`
## Request Body
`application/json`
- `entities` ([] object) — required
The entities to update.
- `doc` (union anyOf) — optional
- **{ user }**
- `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
The time the entity record was last updated.
- `asset` (object) — optional
- `business_unit` (string) — optional
Business unit the asset belongs to.
- `criticality` (enum) — optional — nullable
The criticality level assigned to this asset.
Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
- `environment` (string) — optional
Deployment environment (for example, production, staging).
- `id` (string) — optional
Unique identifier for the asset.
- `model` (string) — optional
Model name or number.
- `name` (string) — optional
Human-readable asset name.
- `owner` (string) — optional
The owner of the asset.
- `serial_number` (string) — optional
Serial number of the asset.
- `vendor` (string) — optional
Vendor or manufacturer.
- `entity` (object) — optional
- `attributes` (object) — optional
Boolean flags describing characteristics of the entity.
- `asset` (boolean) — optional
Whether the entity is classified as an asset.
- `known_redirects` ([] string) — optional
Known redirect URIs or URLs (e.g. OAuth application callbacks).
- `managed` (boolean) — optional
Whether the entity is managed (for example, via a directory service).
- `mfa_enabled` (boolean) — optional
Whether multi-factor authentication is enabled for the entity.
- `oauth_consent_restriction` (string) — optional
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
- `permissions` ([] string) — optional
Action-level permissions granted to this entity (not roles or groups).
- `storage_class` (string) — optional
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
- `watchlists` ([] string) — optional
Watchlist identifiers the entity belongs to (v2).
- `behaviors` (object) — optional
Behavioral signals observed for the entity.
- `anomaly_job_ids` ([] string) — optional
Machine learning anomaly job identifiers (v2).
- `rule_names` ([] string) — optional
Detection rule names that flagged this entity (v2).
- `created_by` (string) — optional
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- `EngineMetadata` (object) — optional
- `Type` (string) — optional
The engine type that produced this entity record.
- `id` (string) — optional
Unique identifier for this entity.
- `lifecycle` (object) — optional
Timestamps tracking the entity lifecycle.
- `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was first observed.
- `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity last generated activity.
- `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was last observed.
- `name` (string) — optional
Human-readable name of the entity.
- `relationships` (object) — optional
Connections between this entity and other entities.
- `accesses_frequently` (object) — optional
Entities this entity accesses frequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `accesses_infrequently` (object) — optional
Entities this entity accesses infrequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `administers` (object) — optional
Entities this entity administers (for example, a user who is an admin of a service).
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `communicates_with` (object) — optional
Entities this entity communicates with.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `depends_on` (object) — optional
Entities this entity depends on.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns` (object) — optional
Entities owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns_inferred` (object) — optional
Entities inferred to be owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `resolution` (object) — optional
Resolution metadata linking this entity to another.
- `resolved_to` (string) — optional
entity.id of the entity this one resolves to
- `risk` (object) — optional
Aggregated risk score for the resolution group.
- `calculated_level` (enum) — optional
Lexical description of the resolution group's aggregated risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the resolution group's aggregated risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the resolution group's aggregated risk score.
- `supervises` (object) — optional
Entities supervised by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `risk` (object) — optional
Risk scoring information for the entity.
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
- `schema_version` (string) — optional
Schema version of the entity record.
- `source` ([] string) — optional
Sources that produced this entity record.
- `sub_type` (string) — optional
Optional sub-type classification for the entity.
- `type` (string) — optional
The entity type.
- `url` (string) — optional
URL associated with the entity.
- `event` (object) — optional
- `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the event was ingested into Elasticsearch.
- `labels` (map string to object) — optional
Custom key-value labels attached to the entity.
- `tags` ([] string) — optional
Tags attached to the entity.
- `user` (object) — optional
Elastic Common Schema (ECS) user fields collected on the entity.
- `domain` ([] string) — optional
Observed user domains.
- `email` ([] string) — optional
Observed email addresses.
- `full_name` ([] string) — optional
Observed full names of the user.
- `hash` ([] string) — optional
Observed user hashes.
- `id` ([] string) — optional
Observed user identifiers.
- `name` (string) — optional
Primary user name.
- `risk` (object) — optional
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score.
- `roles` ([] string) — optional
Observed roles assigned to the user.
- **{ host }**
- `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
The time the entity record was last updated.
- `asset` (object) — optional
- `business_unit` (string) — optional
Business unit the asset belongs to.
- `criticality` (enum) — optional — nullable
The criticality level assigned to this asset.
Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
- `environment` (string) — optional
Deployment environment (for example, production, staging).
- `id` (string) — optional
Unique identifier for the asset.
- `model` (string) — optional
Model name or number.
- `name` (string) — optional
Human-readable asset name.
- `owner` (string) — optional
The owner of the asset.
- `serial_number` (string) — optional
Serial number of the asset.
- `vendor` (string) — optional
Vendor or manufacturer.
- `entity` (object) — optional
- `attributes` (object) — optional
Boolean flags describing characteristics of the entity.
- `asset` (boolean) — optional
Whether the entity is classified as an asset.
- `known_redirects` ([] string) — optional
Known redirect URIs or URLs (e.g. OAuth application callbacks).
- `managed` (boolean) — optional
Whether the entity is managed (for example, via a directory service).
- `mfa_enabled` (boolean) — optional
Whether multi-factor authentication is enabled for the entity.
- `oauth_consent_restriction` (string) — optional
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
- `permissions` ([] string) — optional
Action-level permissions granted to this entity (not roles or groups).
- `storage_class` (string) — optional
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
- `watchlists` ([] string) — optional
Watchlist identifiers the entity belongs to (v2).
- `behaviors` (object) — optional
Behavioral signals observed for the entity.
- `anomaly_job_ids` ([] string) — optional
Machine learning anomaly job identifiers (v2).
- `rule_names` ([] string) — optional
Detection rule names that flagged this entity (v2).
- `created_by` (string) — optional
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- `EngineMetadata` (object) — optional
- `Type` (string) — optional
The engine type that produced this entity record.
- `id` (string) — optional
Unique identifier for this entity.
- `lifecycle` (object) — optional
Timestamps tracking the entity lifecycle.
- `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was first observed.
- `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity last generated activity.
- `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was last observed.
- `name` (string) — optional
Human-readable name of the entity.
- `relationships` (object) — optional
Connections between this entity and other entities.
- `accesses_frequently` (object) — optional
Entities this entity accesses frequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `accesses_infrequently` (object) — optional
Entities this entity accesses infrequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `administers` (object) — optional
Entities this entity administers (for example, a user who is an admin of a service).
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `communicates_with` (object) — optional
Entities this entity communicates with.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `depends_on` (object) — optional
Entities this entity depends on.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns` (object) — optional
Entities owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns_inferred` (object) — optional
Entities inferred to be owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `resolution` (object) — optional
Resolution metadata linking this entity to another.
- `resolved_to` (string) — optional
entity.id of the entity this one resolves to
- `risk` (object) — optional
Aggregated risk score for the resolution group.
- `calculated_level` (enum) — optional
Lexical description of the resolution group's aggregated risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the resolution group's aggregated risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the resolution group's aggregated risk score.
- `supervises` (object) — optional
Entities supervised by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `risk` (object) — optional
Risk scoring information for the entity.
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
- `schema_version` (string) — optional
Schema version of the entity record.
- `source` ([] string) — optional
Sources that produced this entity record.
- `sub_type` (string) — optional
Optional sub-type classification for the entity.
- `type` (string) — optional
The entity type.
- `url` (string) — optional
URL associated with the entity.
- `event` (object) — optional
- `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the event was ingested into Elasticsearch.
- `host` (object) — optional
Elastic Common Schema (ECS) host fields collected on the entity.
- `architecture` ([] string) — optional
Observed CPU architectures.
- `domain` ([] string) — optional
Observed host domains.
- `hostname` ([] string) — optional
Observed hostnames.
- `id` ([] string) — optional
Observed host identifiers.
- `ip` ([] string) — optional
Observed IP addresses.
- `mac` ([] string) — optional
Observed MAC addresses.
- `name` (string) — optional
Primary host name.
- `os` (object) — optional
Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
- `family` (string) — optional
- `full` (string) — optional
- `kernel` (string) — optional
- `name` (union string | [] string) — optional
- `platform` (string) — optional
- `type` (union string | [] string) — optional
- `version` (string) — optional
- `risk` (object) — optional
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score.
- `type` ([] string) — optional
Observed host types.
- `labels` (map string to object) — optional
Custom key-value labels attached to the entity.
- `tags` ([] string) — optional
Tags attached to the entity.
- **{ service }**
- `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
The time the entity record was last updated.
- `asset` (object) — optional
- `business_unit` (string) — optional
Business unit the asset belongs to.
- `criticality` (enum) — optional — nullable
The criticality level assigned to this asset.
Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
- `environment` (string) — optional
Deployment environment (for example, production, staging).
- `id` (string) — optional
Unique identifier for the asset.
- `model` (string) — optional
Model name or number.
- `name` (string) — optional
Human-readable asset name.
- `owner` (string) — optional
The owner of the asset.
- `serial_number` (string) — optional
Serial number of the asset.
- `vendor` (string) — optional
Vendor or manufacturer.
- `entity` (object) — optional
- `attributes` (object) — optional
Boolean flags describing characteristics of the entity.
- `asset` (boolean) — optional
Whether the entity is classified as an asset.
- `known_redirects` ([] string) — optional
Known redirect URIs or URLs (e.g. OAuth application callbacks).
- `managed` (boolean) — optional
Whether the entity is managed (for example, via a directory service).
- `mfa_enabled` (boolean) — optional
Whether multi-factor authentication is enabled for the entity.
- `oauth_consent_restriction` (string) — optional
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
- `permissions` ([] string) — optional
Action-level permissions granted to this entity (not roles or groups).
- `storage_class` (string) — optional
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
- `watchlists` ([] string) — optional
Watchlist identifiers the entity belongs to (v2).
- `behaviors` (object) — optional
Behavioral signals observed for the entity.
- `anomaly_job_ids` ([] string) — optional
Machine learning anomaly job identifiers (v2).
- `rule_names` ([] string) — optional
Detection rule names that flagged this entity (v2).
- `created_by` (string) — optional
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- `EngineMetadata` (object) — optional
- `Type` (string) — optional
The engine type that produced this entity record.
- `id` (string) — optional
Unique identifier for this entity.
- `lifecycle` (object) — optional
Timestamps tracking the entity lifecycle.
- `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was first observed.
- `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity last generated activity.
- `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was last observed.
- `name` (string) — optional
Human-readable name of the entity.
- `relationships` (object) — optional
Connections between this entity and other entities.
- `accesses_frequently` (object) — optional
Entities this entity accesses frequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `accesses_infrequently` (object) — optional
Entities this entity accesses infrequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `administers` (object) — optional
Entities this entity administers (for example, a user who is an admin of a service).
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `communicates_with` (object) — optional
Entities this entity communicates with.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `depends_on` (object) — optional
Entities this entity depends on.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns` (object) — optional
Entities owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns_inferred` (object) — optional
Entities inferred to be owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `resolution` (object) — optional
Resolution metadata linking this entity to another.
- `resolved_to` (string) — optional
entity.id of the entity this one resolves to
- `risk` (object) — optional
Aggregated risk score for the resolution group.
- `calculated_level` (enum) — optional
Lexical description of the resolution group's aggregated risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the resolution group's aggregated risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the resolution group's aggregated risk score.
- `supervises` (object) — optional
Entities supervised by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `risk` (object) — optional
Risk scoring information for the entity.
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
- `schema_version` (string) — optional
Schema version of the entity record.
- `source` ([] string) — optional
Sources that produced this entity record.
- `sub_type` (string) — optional
Optional sub-type classification for the entity.
- `type` (string) — optional
The entity type.
- `url` (string) — optional
URL associated with the entity.
- `event` (object) — optional
- `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the event was ingested into Elasticsearch.
- `labels` (map string to object) — optional
Custom key-value labels attached to the entity.
- `service` (object) — optional
Elastic Common Schema (ECS) service fields collected on the entity.
- `address` (string) — optional
Service address.
- `environment` (string) — optional
Service environment (for example, production, staging).
- `ephemeral_id` (string) — optional
Ephemeral identifier of the service.
- `id` (string) — optional
Unique identifier of the service.
- `name` (string) — optional
Primary service name.
- `node` (object) — optional
Node information for the service.
- `name` (string) — optional
Node name.
- `role` (string) — optional
Node role.
- `roles` ([] string) — optional
Node roles.
- `risk` (object) — optional
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score.
- `state` (string) — optional
Current state of the service.
- `type` (string) — optional
Service type.
- `version` (string) — optional
Service version.
- `tags` ([] string) — optional
Tags attached to the entity.
- **{ cloud, orchestrator }**
- `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
The time the entity record was last updated.
- `asset` (object) — optional
- `business_unit` (string) — optional
Business unit the asset belongs to.
- `criticality` (enum) — optional — nullable
The criticality level assigned to this asset.
Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
- `environment` (string) — optional
Deployment environment (for example, production, staging).
- `id` (string) — optional
Unique identifier for the asset.
- `model` (string) — optional
Model name or number.
- `name` (string) — optional
Human-readable asset name.
- `owner` (string) — optional
The owner of the asset.
- `serial_number` (string) — optional
Serial number of the asset.
- `vendor` (string) — optional
Vendor or manufacturer.
- `cloud` (object) — optional
Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
- `account` (object) — optional
- `id` (string) — optional
- `name` (string) — optional
- `availability_zone` (string) — optional
- `instance` (object) — optional
- `id` (string) — optional
- `name` (string) — optional
- `machine` (object) — optional
- `type` (string) — optional
- `project` (object) — optional
- `id` (string) — optional
- `name` (string) — optional
- `provider` (string) — optional
- `region` (string) — optional
- `service` (object) — optional
- `name` (string) — optional
- `entity` (object) — optional
- `attributes` (object) — optional
Boolean flags describing characteristics of the entity.
- `asset` (boolean) — optional
Whether the entity is classified as an asset.
- `known_redirects` ([] string) — optional
Known redirect URIs or URLs (e.g. OAuth application callbacks).
- `managed` (boolean) — optional
Whether the entity is managed (for example, via a directory service).
- `mfa_enabled` (boolean) — optional
Whether multi-factor authentication is enabled for the entity.
- `oauth_consent_restriction` (string) — optional
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
- `permissions` ([] string) — optional
Action-level permissions granted to this entity (not roles or groups).
- `storage_class` (string) — optional
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
- `watchlists` ([] string) — optional
Watchlist identifiers the entity belongs to (v2).
- `behaviors` (object) — optional
Behavioral signals observed for the entity.
- `anomaly_job_ids` ([] string) — optional
Machine learning anomaly job identifiers (v2).
- `rule_names` ([] string) — optional
Detection rule names that flagged this entity (v2).
- `created_by` (string) — optional
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- `EngineMetadata` (object) — optional
- `Type` (string) — optional
The engine type that produced this entity record.
- `id` (string) — optional
Unique identifier for this entity.
- `lifecycle` (object) — optional
Timestamps tracking the entity lifecycle.
- `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was first observed.
- `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity last generated activity.
- `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
When the entity was last observed.
- `name` (string) — optional
Human-readable name of the entity.
- `relationships` (object) — optional
Connections between this entity and other entities.
- `accesses_frequently` (object) — optional
Entities this entity accesses frequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `accesses_infrequently` (object) — optional
Entities this entity accesses infrequently.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `administers` (object) — optional
Entities this entity administers (for example, a user who is an admin of a service).
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `communicates_with` (object) — optional
Entities this entity communicates with.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `depends_on` (object) — optional
Entities this entity depends on.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns` (object) — optional
Entities owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `owns_inferred` (object) — optional
Entities inferred to be owned by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `resolution` (object) — optional
Resolution metadata linking this entity to another.
- `resolved_to` (string) — optional
entity.id of the entity this one resolves to
- `risk` (object) — optional
Aggregated risk score for the resolution group.
- `calculated_level` (enum) — optional
Lexical description of the resolution group's aggregated risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the resolution group's aggregated risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the resolution group's aggregated risk score.
- `supervises` (object) — optional
Entities supervised by this entity.
- `ids` ([] string) — optional
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
- `raw_identifiers` (object) — optional
- `entity.id` ([] string) — optional
- `host.id` ([] string) — optional
- `host.name` ([] string) — optional
- `service.name` ([] string) — optional
- `user.email` ([] string) — optional
- `user.id` ([] string) — optional
- `user.name` ([] string) — optional
- `risk` (object) — optional
Risk scoring information for the entity.
- `calculated_level` (enum) — optional
Lexical description of the entity's risk.
Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
- `calculated_score` (number) — optional
The raw numeric value of the given entity's risk score.
- `calculated_score_norm` (number · min: 0 · max: 100) — optional
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
- `schema_version` (string) — optional
Schema version of the entity record.
- `source` ([] string) — optional
Sources that produced this entity record.
- `sub_type` (string) — optional
Optional sub-type classification for the entity.
- `type` (string) — optional
The entity type.
- `url` (string) — optional
URL associated with the entity.
- `event` (object) — optional
- `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
- `labels` (map string to object) — optional
- `orchestrator` (object) — optional
Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
- `api_version` (string) — optional
- `cluster` (object) — optional
- `id` (string) — optional
- `name` (string) — optional
- `url` (string) — optional
- `version` (string) — optional
- `namespace` (string) — optional
- `organization` (string) — optional
- `resource` (object) — optional
- `annotation` (string) — optional
- `id` (string) — optional
- `ip` (string) — optional
- `label` (string) — optional
- `name` (string) — optional
- `parent` (object) — optional
- `type` (string) — optional
- `type` (string) — optional
- `type` (string) — optional
- `tags` ([] string) — optional
- `type` (enum) — required
The entity type of this record.
Values: `user`, `host`, `service`, `generic`
## Responses
#### `200`
Indicates a successful response.
#### `400`
Bad request.
## Code Examples
#### Console
```console
PUT kbn://api/security/entity_store/entities/bulk?force=true
{
"entities": [
{
"type": "host",
"doc": {
"entity": {
"id": "host:web-server-prod-01",
"name": "web-server-prod-01",
"type": "host",
"attributes": { "asset": true }
},
"host": { "name": "web-server-prod-01" }
}
}
]
}
```
#### curl
```curl
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"entities":[{"type":"host","doc":{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","attributes":{"asset":true}},"host":{"name":"web-server-prod-01"}}}]}' \
"${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true"
```
## Response Examples
#### Partial success with errors
Some entities were updated but others encountered Elasticsearch-level errors.
```json
{
"errors": [
{
"_id": "5de9f93a68a72532e736bf5a6184b06300b9cabf",
"reason": "[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing",
"status": 404,
"type": "document_missing_exception"
}
],
"ok": true
}
```
#### All entities updated
All entities were successfully updated with no errors.
```json
{
"errors": [],
"ok": true
}
```
#### Protected fields without force
The request attempts to update protected fields without the force query parameter.
```json
{
"error": "Bad Request",
"message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
"statusCode": 400
}
```