Get an agent's access control list

Base URL: https://{kibana_url}

GET /api/agent_builder/agents/{id}/access_control
GET /s/{space_id}/api/agent_builder/agents/{id}/access_control

Auth

Get the access control for a specific agent. Callers without permission to manage access control receive permissions.update_access_control: false and only their own entry. To learn more about agents, refer to the agents documentation.

Required authorization

Privileges agentBuilder:read

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string required: The unique identifier of the agent whose access control to retrieve.

Responses

200

Indicates a successful response

application/json

404

Not Found — no agent with this ID is visible to the caller. Matches the existing agentNotFound shape, so unprivileged callers cannot probe for hidden agents.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn://api/agent_builder/agents/{id}/access_control

curl Shell

curl \
  -X GET "${KIBANA_URL}/api/agent_builder/agents/{id}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}"

Response

Example response for a caller without manage permission — only the caller's own entry is returned.

{
  "access_control": {
    "access_mode": "private",
    "entries": [
      {
        "added_at": "2026-02-11T10:15:00.000Z",
        "id": "u_bob_profile_uid",
        "role": "user",
        "type": "user"
      }
    ]
  },
  "permissions": {
    "update_access_control": false
  }
}

{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Agent custom-agent-id not found",
  "statusCode": 404
}