---
type: api
title: Update a monitored user
description: **Deprecated in 9.4.0.** Use the Watchlists API instead.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-updateprivmonuser
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-updateprivmonuser
products:
  - Kibana
---

# Update a monitored user

deprecated

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/entity_analytics/monitoring/users/{id}`

#### Path parameters

- `id` (string) — required
  The document ID of the monitored user to update

## Description

**Deprecated in 9.4.0.** Use the Watchlists API instead.

Updates the details of an existing monitored privileged user by their document ID.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Request body

`application/json`

- `entity_analytics_monitoring` (object) — optional
  - `labels` (object[]) — optional
    - `field` (string · max length: 256) — required
    - `source` (string) — required
    - `value` (string · max length: 256) — required
- `id` (string · max length: 256) — optional
- `labels` (object) — optional
  - `source_ids` (string[] · max items: 100) — optional
  - `source_integrations` (string[] · max items: 100) — optional
  - `sources` (enum[] · max items: 100) — optional
    Values: `csv`, `index_sync`, `api`
- `user` (object) — optional
  - `is_privileged` (boolean) — optional
    Indicates if the user is privileged.
  - `name` (string · max length: 512) — optional

## Response

User updated successfully

`application/json`

- `entity_analytics_monitoring` (object)
  - `labels` (object[])
    - `field` (string · max length: 256)
    - `source` (string)
    - `value` (string · max length: 256)
- `id` (string · max length: 256)
- `labels` (object)
  - `source_ids` (string[] · max items: 100)
  - `source_integrations` (string[] · max items: 100)
  - `sources` (enum[] · max items: 100)
    Values: `csv`, `index_sync`, `api`
- `user` (object)
  - `is_privileged` (boolean)
    Indicates if the user is privileged.
  - `name` (string · max length: 512)
- `@timestamp` (string · format: date-time)
- `event` (object)
  - `@timestamp` (string · format: date-time)
  - `ingested` (string · format: date-time)
## Code examples

#### Console

```console
PUT kbn:/api/entity_analytics/monitoring/users/ID
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}
```

#### curl

```curl
curl -X PUT "${KIBANA_URL}/api/entity_analytics/monitoring/users/${ID}" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "Security"
        }
      ]
    },
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  }'
```

## Response examples

#### Updated monitored user

```json
{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}
```