---
type: api
title: Install the Entity Store
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-post-security-entity-store-install
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-post-security-entity-store-install
products:
  - Kibana
---

# Install the Entity Store

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/security/entity_store/install`
- `POST` `/s/{space_id}/api/security/entity_store/install`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Install the Entity Store and create engines for the specified entity types. `logExtraction` sets overrides that apply to all entity types, on top of built-in defaults per entity type. The default `frequency` is 1m for `host` and `user`, 10m for `service` and 30m for `generic`. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the entity type default. To change settings after install, use the update endpoint.

## Required authorization

- Privileges: `securitySolution`

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

- `entityTypes` (enum[] · default: [
  "user",
  "host",
  "service",
  "generic"
]) — optional
  Values: `user`, `host`, `service`, `generic`
- `excludedUserNames` (string[] · max items: 200) — optional
- `historySnapshot` (object) — optional
  - `frequency` (string · max length: 32 · pattern: [smdh]$) — optional
  - `retentionDays` (integer · min: 1 · max: 3650) — optional
- `logExtraction` (object) — optional
  - `additionalIndexPatterns` (string[] · max items: 1000) — optional — nullable
  - `delay` (string · max length: 32 · pattern: [smdh]$) — optional — nullable
  - `docsLimit` (integer · min: 1 · max: 9007199254740991) — optional — nullable
  - `excludedIndexPatterns` (string[] · max items: 1000) — optional — nullable
  - `fieldHistoryLength` (integer · min: -9007199254740991 · max: 9007199254740991) — optional — nullable
  - `frequency` (string · max length: 32 · pattern: [smdh]$) — optional — nullable
  - `lookbackPeriod` (string · max length: 32 · pattern: [smdh]$) — optional — nullable
  - `maxLogsPerPage` (integer · min: 1 · max: 9007199254740991) — optional — nullable
  - `maxLogsPerWindow` (integer · min: 0 · max: 9007199254740991) — optional — nullable
  - `maxLogsPerWindowCapBehavior` (enum) — optional — nullable
    Values: `defer`, `drop`
  - `maxTimeWindowSize` (string · max length: 32 · pattern: [smdh]$) — optional — nullable

## Responses

#### `200`

Indicates all requested entity types are already installed.

`application/json`

#### `201`

Indicates the Entity Store was successfully installed.

`application/json`

#### `403`

Insufficient privileges.

`application/json`

## Code examples

#### Console

```console
POST kbn://api/security/entity_store/install
{
  "entityTypes": ["user", "host", "service", "generic"],
  "logExtraction": {}
}
```

#### curl

```curl
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entityTypes":["user","host","service","generic"],"logExtraction":{}}' \
  "${KIBANA_URL}/api/security/entity_store/install"
```

## Response examples

#### Already installed

All requested entity types were already installed.

```json
{
  "ok": true
}
```

#### Entity Store installed

The Entity Store was installed and engines are being created.

```json
{
  "ok": true
}
```

#### Insufficient privileges

The user does not have the required Elasticsearch privileges.

```json
{
  "error": "Forbidden",
  "message": "User \u0027analyst\u0027 has insufficient privileges",
  "statusCode": 403
}
```