Update a conversation's access control

Base URL: https://{kibana_url}

PUT /api/agent_builder/conversations/{conversation_id}/access_control

Replace a conversation's access mode and member list. Only the conversation owner can call this endpoint; every other caller receives a not-found response. Each call replaces the entire access control — the most recent successful update wins. Members can read and continue the conversation, but still need access to the conversation's agent. To learn more about agent conversations, refer to the agent chat documentation.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Header parameters

Request body

Responses

200

Indicates a successful response

application/json

400

Bad Request — the request body failed validation.

application/json

404

Not Found — no conversation with this ID is readable by the caller, or the caller is not its owner. Matches the existing conversationNotFound shape, so members cannot distinguish a conversation they may not re-share from one that does not exist.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn://api/agent_builder/conversations/{conversation_id}/access_control
{
  "access_mode": "private",
  "entries": [
    { "type": "user", "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0", "role": "member" }
  ]
}

curl Shell

curl \
  -X PUT "${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "access_mode": "private",
    "entries": [
      { "type": "user", "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0", "role": "member" }
    ]
  }'

Response

Two entries name the same user id.

{
  "error": "Bad Request",
  "message": "Duplicate ACL entry for user \u0022u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\u0022",
  "statusCode": 400
}

{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Conversation my-conversation-id not found",
  "statusCode": 404
}

Request Console 1 / 2 languages

Switch the conversation to public so any user with access to its agent can read and continue it. A public conversation is already open to everyone with agent access, so entries must be empty.

Console Kibana Dev Tools

PUT kbn:/api/agent_builder/conversations/CONVERSATION_ID/access_control
{
  "access_mode": "public",
  "entries": []
}

Generated from the API spec

curl Shell

curl \
  -X PUT "${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "access_mode": "public",
    "entries": []
  }'

Generated from the API spec

Response

Example response returning the persisted access control. added_at is stamped by the server for newly added members and preserved for members that were already listed.

{
  "access_mode": "private",
  "entries": [
    {
      "added_at": "2026-08-11T10:00:00.000Z",
      "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
      "role": "member",
      "type": "user"
    },
    {
      "added_at": "2026-08-11T11:30:00.000Z",
      "id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
      "role": "member",
      "type": "user"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "Duplicate ACL entry for user \u0022u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\u0022",
  "statusCode": 400
}

{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Conversation my-conversation-id not found",
  "statusCode": 404
}

Request Console 1 / 2 languages

Example request sharing a private conversation with two users. They can read and continue the conversation, provided they also have access to its agent.

Console Kibana Dev Tools

PUT kbn:/api/agent_builder/conversations/CONVERSATION_ID/access_control
{
  "access_mode": "private",
  "entries": [
    {
      "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
      "role": "member",
      "type": "user"
    },
    {
      "id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
      "role": "member",
      "type": "user"
    }
  ]
}

Generated from the API spec

curl Shell

curl \
  -X PUT "${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "access_mode": "private",
    "entries": [
      {
        "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
        "role": "member",
        "type": "user"
      },
      {
        "id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
        "role": "member",
        "type": "user"
      }
    ]
  }'

Generated from the API spec

Response

Example response returning the persisted access control. added_at is stamped by the server for newly added members and preserved for members that were already listed.

{
  "access_mode": "private",
  "entries": [
    {
      "added_at": "2026-08-11T10:00:00.000Z",
      "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
      "role": "member",
      "type": "user"
    },
    {
      "added_at": "2026-08-11T11:30:00.000Z",
      "id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
      "role": "member",
      "type": "user"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "Duplicate ACL entry for user \u0022u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\u0022",
  "statusCode": 400
}

{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Conversation my-conversation-id not found",
  "statusCode": 404
}

Request Console 1 / 2 languages

Submit an empty entries list to remove every member. Access then falls back to the access mode alone.

Console Kibana Dev Tools

PUT kbn:/api/agent_builder/conversations/CONVERSATION_ID/access_control
{
  "access_mode": "private",
  "entries": []
}

Generated from the API spec

curl Shell

curl \
  -X PUT "${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "access_mode": "private",
    "entries": []
  }'

Generated from the API spec

Response

Example response returning the persisted access control. added_at is stamped by the server for newly added members and preserved for members that were already listed.

{
  "access_mode": "private",
  "entries": [
    {
      "added_at": "2026-08-11T10:00:00.000Z",
      "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
      "role": "member",
      "type": "user"
    },
    {
      "added_at": "2026-08-11T11:30:00.000Z",
      "id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
      "role": "member",
      "type": "user"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "Duplicate ACL entry for user \u0022u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\u0022",
  "statusCode": 400
}

{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Conversation my-conversation-id not found",
  "statusCode": 404
}

Required authorization

Authentication

Path parameters

Header parameters

Request body { }

Responses

Request body