Update a monitored user

deprecated

Base URL: https://{kibana_url}

PUT /api/entity_analytics/monitoring/users/{id}
PUT /s/{space_id}/api/entity_analytics/monitoring/users/{id}

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Updates the details of an existing monitored privileged user by their document ID.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Request body

Response

User updated successfully

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/entity_analytics/monitoring/users/ID
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/entity_analytics/monitoring/users/${ID}" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "Security"
        }
      ]
    },
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  }'

Generated from the API spec

Response

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Authentication

Path parameters

Request body { }

Response

Request body