List all monitored users

deprecated

Base URL: https://{kibana_url}

GET /api/entity_analytics/monitoring/users/list
GET /s/{space_id}/api/entity_analytics/monitoring/users/list

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Response

List of monitored users

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/entity_analytics/monitoring/users/list

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/entity_analytics/monitoring/users/list" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

[
  {
    "@timestamp": "2026-01-28T12:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "IT"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-28T12:00:00.000Z"
    },
    "id": "user-abc-123",
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  },
  {
    "@timestamp": "2026-01-15T09:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "csv",
          "value": "Security"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-15T09:00:00.000Z"
    },
    "id": "user-def-456",
    "user": {
      "is_privileged": true,
      "name": "jane.smith"
    }
  }
]