Get risk score history for an entity

Base URL: https://{kibana_url}

GET /api/risk_score/history
GET /s/{space_id}/api/risk_score/history

Refer to Spaces for more information.

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

Authentication

Query parameters

Responses

Successful response

application/json

entity_id string · max length: 1000 required
entity_type enum required: Values: host user service generic
entries object[] required
interval string · max length: 10 required: The effective Elasticsearch date_histogram interval expression the entries were aggregated into (for example 3h, 1d, 1w), derived from the requested time range.

400

Invalid request

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/risk_score/history?entity_type=host&entity_id=ENTITY_ID

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/risk_score/history?entity_type=host&entity_id=${ENTITY_ID}" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "entity_id": "alice",
  "entity_type": "user",
  "entries": [
    {
      "@timestamp": "2026-05-20T12:00:00.000Z",
      "calculated_level": "High",
      "calculated_score": 145.2,
      "calculated_score_norm": 72.4,
      "category_1_count": 18,
      "category_1_score": 102,
      "score_type": "base"
    }
  ]
}