---
type: api
title: List all monitored users
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-listprivmonusers
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-listprivmonusers
products:
  - Kibana
---

# List all monitored users

deprecated

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/entity_analytics/monitoring/users/list`
- `GET` `/s/{space_id}/api/entity_analytics/monitoring/users/list`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

**Deprecated in 9.4.0.** Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

## Query String Parameters

- `kql` (string)
  KQL query to filter the list of monitored users

## Response

List of monitored users

`application/json`

Type: `[] object`

- `entity_analytics_monitoring` (object)
  - `labels` ([] object)
    - `field` (string · max: 256)
    - `source` (string)
    - `value` (string · max: 256)
- `id` (string · max: 256)
- `labels` (object)
  - `source_ids` ([] string · max: 100)
  - `source_integrations` ([] string · max: 100)
  - `sources` ([] enum  · max: 100)
    Values: `csv`, `index_sync`, `api`
- `user` (object)
  - `is_privileged` (boolean)
    Indicates if the user is privileged.
  - `name` (string · max: 512)
- `@timestamp` (string)
- `event` (object)
  - `@timestamp` (string)
  - `ingested` (string)
## Code Examples

#### Console

```console
GET /api/entity_analytics/monitoring/users/list
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/entity_analytics/monitoring/users/list"
```

## Response Examples

#### List of monitored users

```json
[
  {
    "@timestamp": "2026-01-28T12:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "IT"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-28T12:00:00.000Z"
    },
    "id": "user-abc-123",
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  },
  {
    "@timestamp": "2026-01-15T09:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "csv",
          "value": "Security"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-15T09:00:00.000Z"
    },
    "id": "user-def-456",
    "user": {
      "is_privileged": true,
      "name": "jane.smith"
    }
  }
]
```