Update an existing watchlist

Base URL: https://{kibana_url}

PUT /api/entity_analytics/watchlists/{id}
PUT /s/{space_id}/api/entity_analytics/watchlists/{id}

Refer to Spaces for more information.

Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.

Authentication

Path parameters

Request body

Response

Watchlist updated successfully

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/entity_analytics/watchlists/ID
{
  "description": "High risk vendor watchlist",
  "managed": false,
  "name": "High Risk Vendors",
  "riskModifier": 1.5
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/entity_analytics/watchlists/${ID}" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "High risk vendor watchlist",
    "managed": false,
    "name": "High Risk Vendors",
    "riskModifier": 1.5
  }'

Generated from the API spec

Response

{
  "createdAt": "2026-01-28T12:00:00.000Z",
  "description": "High risk vendor watchlist",
  "id": "watchlist-123",
  "managed": false,
  "name": "High Risk Vendors",
  "riskModifier": 1.5,
  "updatedAt": "2026-02-18T12:00:00.000Z"
}

Authentication

Path parameters

Request body { }

Response

Request body