Create a new monitored user

deprecated

Server: https://{kibana_url}

POST /api/entity_analytics/monitoring/users
POST /s/{space_id}/api/entity_analytics/monitoring/users

Api key auth Basic auth

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Creates a new privileged user to be monitored by the Privilege Monitoring Engine.

Request

Response

User created successfully

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/entity_analytics/monitoring/users
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "user": {
    "name": "john.doe"
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/entity_analytics/monitoring/users" \
  -H "Content-Type: application/json" \
  -d '{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "user": {
    "name": "john.doe"
  }
}'

Response

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "IT"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Request { entity_analytics_monitoring , user , }

Response

Request