List entities

Base URL: https://{kibana_url}

GET /api/security/entity_store/entities

List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc

curl Shell

curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc"

Response

No entities matched the query.

{
  "page": 1,
  "per_page": 10,
  "records": [],
  "total": 0
}

{
  "error": "Bad Request",
  "message": "Invalid filter: Expected \u0022(\u0022, \u0022{\u0022, value, whitespace but \u0022:\u0022 found.\ninvalid :: query\n---------^",
  "statusCode": 400
}