List entities

Base URL: https://{kibana_url}

GET /api/security/entity_store/entities

Auth

List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.

Required authorization

Privileges securitySolution

Query parameters

filter string: A Kibana Query Language (KQL) filter for the search-after mode.
size integer · min: 1 · max: 9007199254740991: Number of entities to return in search-after mode.
searchAfter string: JSON-encoded search_after value for cursor-based pagination.
source string[]: Fields to include in the response source.
fields string[]: Fields to include in the response.
sort_field string: Field to sort results by in page mode.
sort_order enum: Sort order in page mode.; Values: asc desc
page integer · min: 1 · max: 9007199254740991: Page number to return (1-indexed) in page mode.
per_page integer · min: 1 · max: 10000: Number of entities per page in page mode.
filterQuery string: An Elasticsearch query string to filter entities in page mode.
entity_types enum[]: Entity types to include in the results.; Values: user host service generic

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json