Update a monitored user

deprecated

Server: https://{kibana_url}

PUT /api/entity_analytics/monitoring/users/{id}
PUT /s/{space_id}/api/entity_analytics/monitoring/users/{id}

Api key auth

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Updates the details of an existing monitored privileged user by their document ID.

Path Parameters

id string required: The document ID of the monitored user to update

Request

Response

User updated successfully

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT /api/entity_analytics/monitoring/users/{id}
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

curl Shell

curl -X PUT "https://{kibana_url}/api/entity_analytics/monitoring/users/{id}" \
  -H "Content-Type: application/json" \
  -d '{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}'

Response

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Path Parameters

Request { entity_analytics_monitoring , id , labels , user , }

Response

Request