Upsert multiple monitored users via CSV upload

deprecated

Base URL: https://{kibana_url}

POST /api/entity_analytics/monitoring/users/_csv

Deprecated in 9.4.0. Use the Watchlists API instead.

Bulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Responses

Bulk upload successful

application/json

413

File too large

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/entity_analytics/monitoring/users/_csv
{
  "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/entity_analytics/monitoring/users/_csv" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: multipart/form-data" \
  -d '{
    "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
  }'

Generated from the API spec

Response

{
  "errors": [
    {
      "index": 1,
      "message": "Invalid monitored field",
      "username": "john.doe"
    }
  ],
  "stats": {
    "failedOperations": 1,
    "successfulOperations": 1,
    "totalOperations": 2,
    "uploaded": 2
  }
}