---
type: api
title: Configure the Risk Engine Saved Object
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-configureriskenginesavedobject
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-configureriskenginesavedobject
products:
  - Kibana
---

# Configure the Risk Engine Saved Object

- Server: `https://{kibana_url}`

## Paths

- `PATCH` `/api/risk_score/engine/saved_object/configure`
- `PATCH` `/s/{space_id}/api/risk_score/engine/saved_object/configure`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Configuring the Risk Engine Saved Object

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Request body

`application/json`

- `enable_reset_to_zero` (boolean) — optional
- `exclude_alert_statuses` (string[]) — optional
- `exclude_alert_tags` (string[]) — optional
- `filters` (object[]) — optional
  - `entity_types` (enum[]) — required
    Values: `host`, `user`, `service`
  - `filter` (string) — required
    KQL filter string
- `page_size` (integer · min: 100 · max: 10000) — optional
  Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES|QL result limit (10,000 by default).
- `range` (object) — optional
  - `end` (string) — optional
  - `start` (string) — optional

## Responses

#### `200`

Successful response

`application/json`

- `risk_engine_saved_object_configured` (boolean)
#### `400`

Task manager is unavailable

`application/json`

- `message` (string)
- `status_code` (integer · min: 400)
#### `default`

Unexpected error

`application/json`

- `errors` (object[])
  - `error` (string)
  - `seq` (integer)
- `risk_engine_saved_object_configured` (boolean)
## Code examples

#### Console

```console
PATCH kbn:/api/risk_score/engine/saved_object/configure
{
  "enable_reset_to_zero": false,
  "exclude_alert_statuses": [
    "closed"
  ],
  "exclude_alert_tags": [
    "low-priority"
  ],
  "filters": [
    {
      "entity_types": [
        "host",
        "user"
      ],
      "filter": "host.name: *"
    }
  ],
  "range": {
    "end": "now",
    "start": "now-30d"
  }
}
```

#### curl

```curl
curl -X PATCH "${KIBANA_URL}/api/risk_score/engine/saved_object/configure" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "enable_reset_to_zero": false,
    "exclude_alert_statuses": [
      "closed"
    ],
    "exclude_alert_tags": [
      "low-priority"
    ],
    "filters": [
      {
        "entity_types": [
          "host",
          "user"
        ],
        "filter": "host.name: *"
      }
    ],
    "range": {
      "end": "now",
      "start": "now-30d"
    }
  }'
```

## Response examples

#### Successful configuration response

```json
{
  "risk_engine_saved_object_configured": true
}
```

#### Task manager is unavailable

```json
{
  "message": "Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.",
  "status_code": 400
}
```

#### Configure saved object failed

```json
{
  "errors": [
    {
      "error": "Internal server error",
      "seq": 1
    }
  ],
  "risk_engine_saved_object_configured": false
}
```