---
type: api
title: List entities
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-get-security-entity-store-entities
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-get-security-entity-store-entities
products:
  - Kibana
---

# List entities

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/security/entity_store/entities`
- `GET` `/s/{space_id}/api/security/entity_store/entities`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.<br/><br/>[Required authorization] Route required privileges: securitySolution.

## Query String Parameters

- `filter` (string)
  A Kibana Query Language (KQL) filter for the search-after mode.
- `size` (integer · min: 1 · max: 9007199254740991)
  Number of entities to return in search-after mode.
- `searchAfter` (string)
  JSON-encoded search_after value for cursor-based pagination.
- `source` ([] string)
  Fields to include in the response source.
- `fields` ([] string)
  Fields to include in the response.
- `sort_field` (string)
  Field to sort results by in page mode.
- `sort_order` (enum)
  Sort order in page mode.
  Values: `asc`, `desc`
- `page` (integer · min: 1 · max: 9007199254740991)
  Page number to return (1-indexed) in page mode.
- `per_page` (integer · min: 1 · max: 10000)
  Number of entities per page in page mode.
- `filterQuery` (string)
  An Elasticsearch query string to filter entities in page mode.
- `entity_types` ([] enum)
  Entity types to include in the results.
  Values: `user`, `host`, `service`, `generic`

## Responses

#### `200`

Indicates a successful response.

#### `400`

Bad request.

## Code Examples

#### Console

```console
GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc
```

#### curl

```curl
curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc"
```

## Response Examples

#### Empty result

No entities matched the query.

```json
{
  "page": 1,
  "per_page": 10,
  "records": [],
  "total": 0
}
```

#### Page mode response with host entities

A paginated list of host entities sorted by timestamp in descending order, including query inspection data.

```json
{
  "inspect": {
    "dsl": [
      "{\u0022index\u0022:[\u0022entities-latest-default\u0022],\u0022body\u0022:{\u0022terms\u0022:{\u0022entity.EngineMetadata.Type\u0022:[\u0022host\u0022]}}}"
    ],
    "response": [
      "{\u0022took\u0022:1,\u0022timed_out\u0022:false,\u0022hits\u0022:{\u0022total\u0022:{\u0022value\u0022:1,\u0022relation\u0022:\u0022eq\u0022}}}"
    ]
  },
  "page": 1,
  "per_page": 10,
  "records": [
    {
      "@timestamp": "2026-04-10T08:30:00.000Z",
      "asset": {
        "criticality": "high_impact",
        "environment": "production"
      },
      "entity": {
        "attributes": {
          "asset": true,
          "managed": true
        },
        "id": "host:web-server-prod-01",
        "lifecycle": {
          "first_seen": "2026-01-15T10:00:00.000Z",
          "last_activity": "2026-04-10T08:30:00.000Z"
        },
        "name": "web-server-prod-01",
        "risk": {
          "calculated_level": "Moderate",
          "calculated_score": 47.5,
          "calculated_score_norm": 47.5
        },
        "source": [
          "logs"
        ],
        "type": "host"
      },
      "host": {
        "hostname": [
          "web-server-prod-01.example.com"
        ],
        "ip": [
          "10.0.1.42"
        ],
        "name": "web-server-prod-01",
        "os": {
          "name": "Ubuntu",
          "type": "linux"
        }
      }
    }
  ],
  "total": 1
}
```

#### Search-after mode response

A cursor-based response with entities and a search_after token for the next page.

```json
{
  "entities": [
    {
      "@timestamp": "2026-04-10T08:30:00.000Z",
      "entity": {
        "id": "user:jane.doe@example.com",
        "name": "jane.doe",
        "type": "user"
      },
      "user": {
        "email": [
          "jane.doe@example.com"
        ],
        "name": "jane.doe"
      }
    }
  ],
  "nextSearchAfter": [
    1712736600000,
    1
  ]
}
```

#### Invalid filter

The provided Kibana Query Language filter could not be parsed.

```json
{
  "error": "Bad Request",
  "message": "Invalid filter: Expected \u0022(\u0022, \u0022{\u0022, value, whitespace but \u0022:\u0022 found.\ninvalid :: query\n---------^",
  "statusCode": 400
}
```

#### Mixed pagination modes

Cannot combine page-based pagination with cursor-based pagination in the same request.

```json
{
  "error": "Bad Request",
  "message": "[request query]: Cannot combine page/per_page with searchAfter",
  "statusCode": 400
}
```