---
type: api
title: Install the Entity Store
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-security-entity-store-install
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-security-entity-store-install
products:
  - Kibana
---

# Install the Entity Store

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/security/entity_store/install`
- `POST` `/s/{space_id}/api/security/entity_store/install`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.<br/><br/>[Required authorization] Route required privileges: securitySolution.

## Request Body

`application/json`

- `entityTypes` ([] enum  · default: [
  "user",
  "host",
  "service",
  "generic"
]) — optional
  Values: `user`, `host`, `service`, `generic`
- `excludedUserNames` ([] string · max: 200) — optional
- `historySnapshot` (object) — optional
  - `frequency` (string · max: 32 · pattern: [smdh]$) — optional
  - `retentionDays` (integer · min: 1 · max: 3650) — optional
- `logExtraction` (object) — optional
  - `additionalIndexPatterns` ([] string · max: 1000) — optional — nullable
  - `delay` (string · max: 32 · pattern: [smdh]$) — optional — nullable
  - `docsLimit` (integer · min: 1 · max: 9007199254740991) — optional — nullable
  - `excludedIndexPatterns` ([] string · max: 1000) — optional — nullable
  - `fieldHistoryLength` (integer · min: -9007199254740991 · max: 9007199254740991) — optional — nullable
  - `frequency` (string · max: 32 · pattern: [smdh]$) — optional — nullable
  - `lookbackPeriod` (string · max: 32 · pattern: [smdh]$) — optional — nullable
  - `maxLogsPerPage` (integer · min: 1 · max: 9007199254740991) — optional — nullable
  - `maxLogsPerWindow` (integer · min: 0 · max: 9007199254740991) — optional — nullable
  - `maxLogsPerWindowCapBehavior` (enum) — optional — nullable
    Values: `defer`, `drop`
  - `maxTimeWindowSize` (string · max: 32 · pattern: [smdh]$) — optional — nullable

## Responses

#### `200`

Indicates all requested entity types are already installed.

#### `201`

Indicates the Entity Store was successfully installed.

#### `403`

Insufficient privileges.

## Code Examples

#### Console

```console
POST kbn://api/security/entity_store/install
{
  "entityTypes": ["user", "host", "service", "generic"],
  "logExtraction": {}
}
```

#### curl

```curl
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entityTypes":["user","host","service","generic"],"logExtraction":{}}' \
  "${KIBANA_URL}/api/security/entity_store/install"
```

## Response Examples

#### Already installed

All requested entity types were already installed.

```json
{
  "ok": true
}
```

#### Entity Store installed

The Entity Store was installed and engines are being created.

```json
{
  "ok": true
}
```

#### Insufficient privileges

The user does not have the required Elasticsearch privileges.

```json
{
  "error": "Forbidden",
  "message": "User \u0027analyst\u0027 has insufficient privileges",
  "statusCode": 403
}
```