openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana Security Entity Analytics API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.

    '
  name: Security Entity Analytics API
  x-displayName: Security entity analytics
paths:
  /api/asset_criticality:
    delete:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Entity Store APIs to unassign asset criticality for a specific entity.


        Delete the asset criticality record for a specific entity.

        '
      operationId: DeleteAssetCriticalityRecord
      parameters:
      - description: The ID value of the asset.
        example: my_host
        in: query
        name: id_value
        required: true
        schema:
          type: string
      - description: The field representing the ID.
        example: host.name
        in: query
        name: id_field
        required: true
        schema:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
      - description: If 'wait_for' the request will wait for the index refresh.
        in: query
        name: refresh
        required: false
        schema:
          enum:
          - wait_for
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleted:
                    description: True if the record was deleted or false if the record did not exist.
                    type: boolean
                  record:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
                    description: The deleted record if it existed.
                required:
                - deleted
          description: Successful response
        '400':
          description: Invalid request
      summary: Delete an asset criticality record
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Get the asset criticality record for a specific entity.'
      operationId: GetAssetCriticalityRecord
      parameters:
      - description: The ID value of the asset.
        example: my_host
        in: query
        name: id_value
        required: true
        schema:
          type: string
      - description: The field representing the ID.
        example: host.name
        in: query
        name: id_field
        required: true
        schema:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
          description: Successful response
        '400':
          description: Invalid request
        '404':
          description: Criticality record not found
      summary: Get an asset criticality record
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Entity Store APIs to assign asset criticality to an entity.


        Create or update an asset criticality record for a specific entity.


        If a record already exists for the specified entity, that record is overwritten with the specified value. If a record doesn''t exist for the specified entity, a new record is created.

        '
      operationId: CreateAssetCriticalityRecord
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
              - type: object
                properties:
                  refresh:
                    description: If 'wait_for' the request will wait for the index refresh.
                    enum:
                    - wait_for
                    type: string
              example:
                criticality_level: high_impact
                id_field: host.name
                id_value: my_host
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
          description: Successful response
        '400':
          description: Invalid request
      summary: Upsert an asset criticality record
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/asset_criticality/bulk:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality/bulk</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Entity Store APIs to bulk assign asset criticality.


        Bulk upsert up to 1000 asset criticality records.


        If asset criticality records already exist for the specified entities, those records are overwritten with the specified values. If asset criticality records don''t exist for the specified entities, new records are created.

        '
      operationId: BulkUpsertAssetCriticalityRecords
      requestBody:
        content:
          application/json:
            schema:
              example:
                records:
                - criticality_level: low_impact
                  id_field: host.name
                  id_value: host-1
                - criticality_level: medium_impact
                  id_field: host.name
                  id_value: host-2
              type: object
              properties:
                records:
                  items:
                    allOf:
                    - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
                    - type: object
                      properties:
                        criticality_level:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload'
                      required:
                      - criticality_level
                  maxItems: 1000
                  minItems: 1
                  type: array
              required:
              - records
      responses:
        '200':
          content:
            application/json:
              schema:
                example:
                  errors:
                  - index: 0
                    message: Invalid ID field
                  stats:
                    failed: 1
                    successful: 1
                    total: 2
                type: object
                properties:
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem'
                    type: array
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats'
                required:
                - errors
                - stats
          description: Bulk upload successful
        '413':
          description: File too large
      summary: Bulk upsert asset criticality records
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/asset_criticality/list:
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality/list</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** List asset criticality records, paging, sorting and filtering as needed.'
      operationId: FindAssetCriticalityRecords
      parameters:
      - description: The field to sort by.
        in: query
        name: sort_field
        required: false
        schema:
          enum:
          - id_value
          - id_field
          - criticality_level
          - '@timestamp'
          type: string
      - description: The order to sort by.
        in: query
        name: sort_direction
        required: false
        schema:
          enum:
          - asc
          - desc
          type: string
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          minimum: 1
          type: integer
      - description: The number of records to return per page.
        in: query
        name: per_page
        required: false
        schema:
          maximum: 1000
          minimum: 1
          type: integer
      - description: The kuery to filter by.
        in: query
        name: kuery
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                example:
                  page: 1
                  per_page: 10
                  records:
                  - '@timestamp': '2024-08-02T14:40:35.705Z'
                    asset:
                      criticality: medium_impact
                    criticality_level: medium_impact
                    host:
                      asset:
                        criticality: medium_impact
                      name: my_other_host
                    id_field: host.name
                    id_value: my_other_host
                  - '@timestamp': '2024-08-02T11:15:34.290Z'
                    asset:
                      criticality: high_impact
                    criticality_level: high_impact
                    host:
                      asset:
                        criticality: high_impact
                      name: my_host
                    id_field: host.name
                    id_value: my_host
                  total: 2
                type: object
                properties:
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    maximum: 1000
                    minimum: 1
                    type: integer
                  records:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
                    type: array
                  total:
                    minimum: 0
                    type: integer
                required:
                - records
                - page
                - per_page
                - total
          description: Successfully retrieved asset criticality records
      summary: List asset criticality records
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/engine/delete:
    delete:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/delete</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Deletes the Privilege Monitoring Engine and optionally removes all associated privileged user data.'
      operationId: DeleteMonitoringEngine
      parameters:
      - description: Whether to delete all the privileged user data
        in: query
        name: data
        required: false
        schema:
          default: false
          type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteMonitoringEngineResponse:
                  summary: Engine deleted successfully
                  value:
                    deleted: true
              schema:
                type: object
                properties:
                  deleted:
                    type: boolean
                required:
                - deleted
          description: Successful response
      summary: Delete the Privilege Monitoring Engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/engine/disable:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Disables the Privilege Monitoring Engine, stopping all monitoring activity without removing data.'
      operationId: DisableMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                DisableMonitoringEngineResponse:
                  summary: Engine disabled successfully
                  value:
                    status: disabled
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Successful response
      summary: Disable the Privilege Monitoring Engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/engine/init:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/init</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Initializes the Privilege Monitoring Engine, setting up the required resources and starting the engine.'
      operationId: InitMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                InitMonitoringEngineResponse:
                  summary: Engine initialized successfully
                  value:
                    status: started
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Successful response
        '500':
          content:
            application/json:
              examples:
                InitMonitoringEngineError:
                  summary: Internal server error during engine initialization
                  value:
                    error:
                      message: Failed to initialize monitoring engine
                    status: error
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Internal Server Error
      summary: Initialize the Privilege Monitoring Engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/engine/schedule_now:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/schedule_now</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Schedules the Privilege Monitoring Engine to run as soon as possible, triggering an immediate monitoring cycle.'
      operationId: ScheduleMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                ScheduleMonitoringEngineResponse:
                  summary: Engine scheduled successfully
                  value:
                    success: true
              schema:
                type: object
                properties:
                  success:
                    description: Indicates the scheduling was successful
                    type: boolean
          description: Successful response
        '409':
          content:
            application/json:
              examples:
                ScheduleMonitoringEngineConflict:
                  summary: Engine is already running
                  value:
                    message: Monitoring engine is already running
              schema:
                type: object
                properties:
                  message:
                    description: Error message indicating the engine is already running
                    type: string
          description: Conflict - Monitoring engine is already running
      summary: Schedule the Privilege Monitoring Engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/privileges/health:
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/privileges/health</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Returns the current health status of the Privilege Monitoring Engine, including engine status, error details, and user count statistics.'
      operationId: PrivMonHealth
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivMonHealthResponse:
                  summary: Healthy privilege monitoring engine
                  value:
                    status: started
                    users:
                      current_count: 42
                      max_allowed: 1000
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      message:
                        type: string
                    required:
                    - status
                  status:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus'
                  users:
                    description: User statistics for privilege monitoring
                    type: object
                    properties:
                      current_count:
                        description: Current number of privileged users being monitored
                        type: integer
                      max_allowed:
                        description: Maximum number of privileged users allowed to be monitored
                        type: integer
                    required:
                    - current_count
                    - max_allowed
                required:
                - status
          description: Successful response
      summary: Health check on Privilege Monitoring
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/privileges/privileges:
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/privileges/privileges</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists APIs instead.


        Check if the current user has all required permissions for Privilege Monitoring.

        '
      operationId: PrivMonPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivMonPrivilegesResponse:
                  summary: Privileges check response
                  value:
                    has_all_required: true
                    privileges:
                      elasticsearch:
                        index:
                          .entity_analytics.monitoring.user-default:
                            read: true
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivileges'
          description: Successful response
      summary: Run a privileges check on Privilege Monitoring
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/users:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists API instead.


        Creates a new privileged user to be monitored by the Privilege Monitoring Engine.

        '
      operationId: CreatePrivMonUser
      requestBody:
        content:
          application/json:
            examples:
              CreatePrivMonUserRequest:
                summary: Create a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                    - field: department
                      source: api
                      value: IT
                  user:
                    name: john.doe
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_UserName'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreatePrivMonUserResponse:
                  summary: Created monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                      - field: department
                        source: api
                        value: IT
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
          description: User created successfully
      summary: Create a new monitored user
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/users/_csv:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/_csv</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists API instead.


        Bulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.

        '
      operationId: PrivmonBulkUploadUsersCSV
      requestBody:
        content:
          multipart/form-data:
            examples:
              PrivmonBulkUploadUsersCSVRequest:
                summary: CSV file with privileged users
                value:
                  file: 'username,is_privileged

                    john.doe,true

                    jane.smith,true

                    '
            schema:
              type: object
              properties:
                file:
                  description: The CSV file to upload.
                  format: binary
                  type: string
              required:
              - file
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivmonBulkUploadUsersCSVResponse:
                  summary: Bulk upload response with mixed results
                  value:
                    errors:
                    - index: 1
                      message: Invalid monitored field
                      username: john.doe
                    stats:
                      failedOperations: 1
                      successfulOperations: 1
                      totalOperations: 2
                      uploaded: 2
              schema:
                type: object
                properties:
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem'
                    type: array
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadStats'
                required:
                - errors
                - stats
          description: Bulk upload successful
        '413':
          description: File too large
      summary: Upsert multiple monitored users via CSV upload
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/users/{id}:
    delete:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists API instead.


        Removes a privileged user from monitoring by their document ID.

        '
      operationId: DeletePrivMonUser
      parameters:
      - description: The document ID of the monitored user to delete
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                DeletePrivMonUserResponse:
                  summary: User deleted successfully
                  value:
                    acknowledged: true
                    message: User deleted successfully
              schema:
                type: object
                properties:
                  acknowledged:
                    description: Indicates if the deletion was successful
                    type: boolean
                  message:
                    description: A message providing additional information about the deletion status
                    type: string
                required:
                - success
          description: User deleted successfully
      summary: Delete a monitored user
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists API instead.


        Updates the details of an existing monitored privileged user by their document ID.

        '
      operationId: UpdatePrivMonUser
      parameters:
      - description: The document ID of the monitored user to update
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              UpdatePrivMonUserRequest:
                summary: Update a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                    - field: department
                      source: api
                      value: Security
                  user:
                    is_privileged: true
                    name: john.doe
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdatePrivMonUserResponse:
                  summary: Updated monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                      - field: department
                        source: api
                        value: Security
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
          description: User updated successfully
      summary: Update a monitored user
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/monitoring/users/list:
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/list</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **Deprecated in 9.4.0.** Use the Watchlists API instead.


        Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

        '
      operationId: ListPrivMonUsers
      parameters:
      - description: KQL query to filter the list of monitored users
        in: query
        name: kql
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ListPrivMonUsersResponse:
                  summary: List of monitored users
                  value:
                  - '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                      - field: department
                        source: api
                        value: IT
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
                  - '@timestamp': '2026-01-15T09:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                      - field: department
                        source: csv
                        value: Security
                    event:
                      ingested: '2026-01-15T09:00:00.000Z'
                    id: user-def-456
                    user:
                      is_privileged: true
                      name: jane.smith
              schema:
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
                type: array
          description: List of monitored users
      summary: List all monitored users
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/install:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/install</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Installs the privileged access detection integration package and sets up the associated ML modules required for the Entity Analytics privileged user monitoring experience.'
      operationId: InstallPrivilegedAccessDetectionPackage
      responses:
        '200':
          content:
            application/json:
              examples:
                InstallPrivilegedAccessDetectionPackageResponse:
                  summary: Package installed successfully
                  value:
                    message: Privileged access detection package installed successfully
              schema:
                type: object
                properties:
                  message:
                    type: string
                required:
                - message
          description: Successful response
      summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/status:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/status</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.'
      operationId: GetPrivilegedAccessDetectionPackageStatus
      responses:
        '200':
          content:
            application/json:
              examples:
                GetPrivilegedAccessDetectionPackageStatusResponse:
                  summary: Package fully installed and running
                  value:
                    jobs:
                    - description: Detects high-risk login patterns
                      job_id: pad-high-risk-login
                      state: opened
                    - description: Detects privilege escalation events
                      job_id: pad-privilege-escalation
                      state: opened
                    ml_module_setup_status: complete
                    package_installation_status: complete
              schema:
                type: object
                properties:
                  jobs:
                    items:
                      type: object
                      properties:
                        description:
                          type: string
                        job_id:
                          type: string
                        state:
                          enum:
                          - closing
                          - closed
                          - opened
                          - failed
                          - opening
                          type: string
                      required:
                      - job_id
                      - state
                    type: array
                  ml_module_setup_status:
                    enum:
                    - complete
                    - incomplete
                    type: string
                  package_installation_status:
                    enum:
                    - complete
                    - incomplete
                    type: string
                required:
                - package_installation_status
                - ml_module_setup_status
                - jobs
          description: Privileged access detection status retrieved
      summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.'
      operationId: CreateWatchlist
      requestBody:
        content:
          application/json:
            examples:
              CreateWatchlistRequest:
                summary: Create watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
              CreateWatchlistWithSourcesRequest:
                summary: Create watchlist with entity sources
                value:
                  description: High risk vendor watchlist
                  entitySources:
                  - enabled: true
                    identifierField: user.name
                    indexPattern: my-sync-index
                    name: My User Index Source
                    type: index
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
            schema:
              type: object
              properties:
                description:
                  description: Description of the watchlist
                  maxLength: 1000
                  type: string
                entitySources:
                  description: Optional entity sources to create and link to the watchlist
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      enabled:
                        type: boolean
                      filter:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_Filter'
                      identifierField:
                        description: Field used to query the entity store for index-type sources
                        maxLength: 256
                        type: string
                      indexPattern:
                        maxLength: 1000
                        type: string
                      integrationName:
                        description: Required when type is entity_analytics_integration. One of entityanalytics_okta, entityanalytics_ad.
                        maxLength: 256
                        type: string
                      matchers:
                        items:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_Matcher'
                        maxItems: 100
                        type: array
                      name:
                        maxLength: 256
                        type: string
                      queryRule:
                        description: KQL query used to filter data from the provided index patterns
                        maxLength: 4096
                        type: string
                      range:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_DateRange'
                      type:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_EntitySourceType'
                    required:
                    - type
                    - name
                  maxItems: 100
                  type: array
                managed:
                  description: Indicates if the watchlist is managed by the system
                  type: boolean
                name:
                  description: Unique name for the watchlist
                  maxLength: 256
                  type: string
                riskModifier:
                  description: Risk score modifier associated with the watchlist
                  maximum: 2
                  minimum: 0
                  type: number
              required:
              - name
              - riskModifier
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateWatchlistResponse:
                  summary: Created watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-01-28T12:00:00.000Z'
              schema:
                allOf:
                - $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
                - type: object
                  properties:
                    entitySources:
                      items:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySource'
                      type: array
          description: Watchlist created successfully
      summary: Create a new watchlist
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists/{id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves the details of an entity analytics watchlist by its unique identifier.'
      operationId: GetWatchlist
      parameters:
      - description: Unique ID of the watchlist
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                GetWatchlistResponse:
                  summary: Watchlist details
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
          description: Watchlist details
      summary: Get a watchlist by ID
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.'
      operationId: UpdateWatchlist
      parameters:
      - description: The ID of the watchlist to update
        in: path
        name: id
        required: true
        schema:
          maxLength: 256
          type: string
      requestBody:
        content:
          application/json:
            examples:
              UpdateWatchlistRequest:
                summary: Update watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
            schema:
              type: object
              properties:
                description:
                  description: Description of the watchlist
                  maxLength: 1000
                  type: string
                managed:
                  description: Indicates if the watchlist is managed by the system
                  type: boolean
                name:
                  description: Unique name of the watchlist
                  maxLength: 256
                  type: string
                riskModifier:
                  description: Risk score modifier associated with the watchlist
                  maximum: 2
                  minimum: 0
                  type: number
              required:
              - name
              - riskModifier
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateWatchlistResponse:
                  summary: Updated watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
          description: Watchlist updated successfully
      summary: Update an existing watchlist
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/csv_upload:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/csv_upload</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row

        with a "type" column (user, host, service, or generic) and one or more ECS identity

        fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.


        Matched entities are added to the watchlist and their `entity.attributes.watchlists`

        field is updated in the entity store.


        Each row will match up to 10,000 entities.

        '
      operationId: UploadWatchlistCsv
      parameters:
      - description: The ID of the watchlist to add entities to
        example: high-risk-vendors
        in: path
        name: watchlist_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              csvUpload:
                summary: CSV file with user entities
                value:
                  file: 'type,user.name

                    user,john.doe

                    user,jane.smith

                    '
            schema:
              type: object
              properties:
                file:
                  description: The CSV file to upload.
                  format: binary
                  type: string
              required:
              - file
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CsvUploadResponse:
                  summary: CSV upload response with mixed results
                  value:
                    failed: 1
                    items:
                    - matchedEntities: 1
                      status: success
                    - error: Invalid entity type
                      matchedEntities: 0
                      status: failure
                    - matchedEntities: 0
                      status: unmatched
                    successful: 1
                    total: 3
                    unmatched: 1
              schema:
                type: object
                properties:
                  failed:
                    description: Number of rows that failed to process
                    example: 1
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem'
                    type: array
                  successful:
                    description: Number of rows that matched at least one entity
                    example: 1
                    type: integer
                  total:
                    description: Total number of rows processed
                    example: 3
                    type: integer
                  unmatched:
                    description: Number of rows that matched no entities
                    example: 1
                    type: integer
                required:
                - successful
                - failed
                - total
                - unmatched
                - items
          description: Upload successful
        '413':
          description: File too large
      summary: Upload a CSV file to add entities to a watchlist
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/entities/assign:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/assign</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Assigns the provided entities to the specified watchlist using a "manual" source label.

        The entities must already exist in the entity store.


        If an entity is already on the watchlist, no new document is created — the "manual" label

        is added to its existing source labels instead.

        '
      operationId: AssignWatchlistEntities
      parameters:
      - description: The ID of the watchlist to add entities to
        example: high-risk-vendors
        in: path
        name: watchlist_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              assignEntities:
                summary: Assign two entities to a watchlist
                value:
                  euids:
                  - user:john.doe
                  - host:web-01
            schema:
              type: object
              properties:
                euids:
                  description: The EUIDs of the entities to assign
                  example:
                  - user:john.doe
                  - host:web-01
                  items:
                    type: string
                  type: array
              required:
              - euids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                assignEntitiesResponse:
                  summary: Successful assignment of two entities
                  value:
                    failed: 0
                    items:
                    - euid: user:john.doe
                      status: success
                    - euid: host:web-01
                      status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
              schema:
                type: object
                properties:
                  failed:
                    description: Number of entities that failed to process
                    example: 0
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem'
                    type: array
                  not_found:
                    description: Number of entities not found in the entity store
                    example: 1
                    type: integer
                  successful:
                    description: Number of entities successfully assigned
                    example: 1
                    type: integer
                  total:
                    description: Total number of entities processed
                    example: 2
                    type: integer
                required:
                - successful
                - failed
                - not_found
                - total
                - items
          description: Assignment successful
      summary: Manually assign entities to a watchlist
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/entities/unassign:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Unassigns the provided entities from the specified watchlist.

        This only removes the "manual" assignment. If the entity is also

        assigned via other sources (for example, index or integration), it will

        remain on the watchlist.

        '
      operationId: UnassignWatchlistEntities
      parameters:
      - description: The ID of the watchlist to remove entities from
        example: high-risk-vendors
        in: path
        name: watchlist_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              unassignEntities:
                summary: Unassign two entities from a watchlist
                value:
                  euids:
                  - user:john.doe
                  - host:web-01
            schema:
              type: object
              properties:
                euids:
                  description: The EUIDs of the entities to unassign
                  example:
                  - user:john.doe
                  - host:web-01
                  items:
                    type: string
                  type: array
              required:
              - euids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                unassignEntitiesResponse:
                  summary: Successful unassignment of two entities
                  value:
                    failed: 0
                    items:
                    - euid: user:john.doe
                      status: success
                    - euid: host:web-01
                      status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
              schema:
                type: object
                properties:
                  failed:
                    description: Number of entities that failed to process
                    example: 0
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem'
                    type: array
                  not_found:
                    description: Number of entities not found in the manual watchlist assignment
                    example: 1
                    type: integer
                  successful:
                    description: Number of entities successfully unassigned
                    example: 1
                    type: integer
                  total:
                    description: Total number of entities processed
                    example: 2
                    type: integer
                required:
                - successful
                - failed
                - not_found
                - total
                - items
          description: Unassignment successful
      summary: Manually unassign entities from a watchlist
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/entity_analytics/watchlists/list:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/list</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns a list of all entity analytics watchlists.'
      operationId: ListWatchlists
      responses:
        '200':
          content:
            application/json:
              examples:
                ListWatchlistsResponse:
                  summary: List of watchlists
                  value:
                  - createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
                  - createdAt: '2026-01-10T09:30:00.000Z'
                    description: Privileged user monitoring watchlist
                    id: watchlist-456
                    managed: true
                    name: Privileged Accounts
                    riskModifier: 2
                    updatedAt: '2026-02-01T15:45:00.000Z'
              schema:
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
                type: array
          description: List of watchlists
      summary: List all watchlists
      tags:
      - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/risk_score/engine/dangerously_delete_data:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/dangerously_delete_data</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Cleaning up the the Risk Engine by removing the indices, mapping and transforms'
      operationId: CleanUpRiskEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                CleanUpRiskEngineResponse:
                  summary: Successful cleanup response
                  value:
                    cleanup_successful: true
              schema:
                type: object
                properties:
                  cleanup_successful:
                    type: boolean
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                cleanupFailed:
                  summary: Cleanup failed
                  value:
                    cleanup_successful: false
                    errors:
                    - error: Risk engine is disabled or deleted already.
                      seq: 1
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse'
          description: Unexpected error
      summary: Cleanup the Risk Engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/risk_score/engine/saved_object/configure:
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/saved_object/configure</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Configuring the Risk Engine Saved Object'
      operationId: ConfigureRiskEngineSavedObject
      requestBody:
        content:
          application/json:
            examples:
              ConfigureRiskEngineSavedObjectRequest:
                summary: Configure the risk engine saved object
                value:
                  enable_reset_to_zero: false
                  exclude_alert_statuses:
                  - closed
                  exclude_alert_tags:
                  - low-priority
                  filters:
                  - entity_types:
                    - host
                    - user
                    filter: 'host.name: *'
                  range:
                    end: now
                    start: now-30d
            schema:
              type: object
              properties:
                enable_reset_to_zero:
                  type: boolean
                exclude_alert_statuses:
                  items:
                    type: string
                  type: array
                exclude_alert_tags:
                  items:
                    type: string
                  type: array
                filters:
                  items:
                    type: object
                    properties:
                      entity_types:
                        items:
                          enum:
                          - host
                          - user
                          - service
                          type: string
                        type: array
                      filter:
                        description: KQL filter string
                        type: string
                    required:
                    - entity_types
                    - filter
                  type: array
                page_size:
                  description: 'Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES|QL result limit (10,000 by default).

                    '
                  maximum: 10000
                  minimum: 100
                  type: integer
                range:
                  type: object
                  properties:
                    end:
                      type: string
                    start:
                      type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ConfigureRiskEngineSavedObjectResponse:
                  summary: Successful configuration response
                  value:
                    risk_engine_saved_object_configured: true
              schema:
                type: object
                properties:
                  risk_engine_saved_object_configured:
                    type: boolean
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                configureError:
                  summary: Configure saved object failed
                  value:
                    errors:
                    - error: Internal server error
                      seq: 1
                    risk_engine_saved_object_configured: false
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse'
          description: Unexpected error
      summary: Configure the Risk Engine Saved Object
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/risk_score/engine/schedule_now:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/schedule_now</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Schedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality.'
      operationId: ScheduleRiskEngineNow
      requestBody:
        content:
          application/json:
            examples:
              emptyRequest:
                summary: No request body
                value: {}
            schema:
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                ScheduleRiskEngineNowResponse:
                  summary: Successful schedule response
                  value:
                    success: true
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowResponse'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                scheduleNowError:
                  summary: Schedule now failed
                  value:
                    full_error: '{}'
                    message: Internal server error
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse'
          description: Unexpected error
      summary: Run the risk scoring engine
      tags:
      - Security Entity Analytics API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/risk_score/history:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/history</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.'
      operationId: GetRiskScoreHistory
      parameters:
      - description: The type of entity to retrieve history for.
        in: query
        name: entity_type
        required: true
        schema:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdentifierType'
      - description: The identifier of the entity to retrieve history for.
        in: query
        name: entity_id
        required: true
        schema:
          maxLength: 1000
          type: string
      - description: Start of the time range, in date-math syntax. Defaults to 90 days ago.
        in: query
        name: from
        required: false
        schema:
          default: now-90d
          maxLength: 100
          type: string
      - description: End of the time range, in date-math syntax. Defaults to now.
        in: query
        name: to
        required: false
        schema:
          default: now
          maxLength: 100
          type: string
      - description: Filter entries by the type of score recorded (`base`, `propagated`, or `resolution`).
        in: query
        name: score_type
        required: false
        schema:
          enum:
          - base
          - propagated
          - resolution
          type: string
      - description: When true, each entry also includes the contributions recorded for that scoring run (`inputs`, `modifiers`, category 2 fields, and `criticality_level`), when present on the underlying document.
        in: query
        name: include_contributions
        required: false
        schema:
          default: false
          type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                riskScoreHistory:
                  summary: Risk score history for a user
                  value:
                    entity_id: alice
                    entity_type: user
                    entries:
                    - '@timestamp': '2026-05-20T12:00:00.000Z'
                      calculated_level: High
                      calculated_score: 145.2
                      calculated_score_norm: 72.4
                      category_1_count: 18
                      category_1_score: 102
                      score_type: base
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryResponse'
          description: Successful response
        '400':
          description: Invalid request
      summary: Get risk score history for an entity
      tags:
      - Security Entity Analytics API
      x-state: Added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem:
      example:
        euid: user:john.doe
        status: success
      type: object
      properties:
        error:
          description: Error message if the entity failed to process
          example: Invalid entity type
          type: string
        euid:
          description: The EUID of the entity
          example: user:john.doe
          type: string
        status:
          enum:
          - success
          - failure
          - not_found
          example: success
          type: string
      required:
      - euid
      - status
    Security_Entity_Analytics_API_EntitySourceType:
      enum:
      - index
      - entity_analytics_integration
      - store
      type: string
    Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem:
      example:
        euid: user:john.doe
        status: success
      type: object
      properties:
        error:
          description: Error message if the entity failed to process
          example: Invalid entity type
          type: string
        euid:
          description: The EUID of the entity
          example: user:john.doe
          type: string
        status:
          enum:
          - success
          - failure
          - not_found
          example: success
          type: string
      required:
      - euid
      - status
    Security_Entity_Analytics_API_Filter:
      type: object
      properties:
        kuery:
          oneOf:
          - maxLength: 4096
            type: string
          - additionalProperties: false
            type: object
    Security_Entity_Analytics_API_MonitoredUserDoc:
      allOf:
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc'
      - type: object
        properties:
          '@timestamp':
            format: date-time
            type: string
          event:
            type: object
            properties:
              '@timestamp':
                format: date-time
                type: string
              ingested:
                format: date-time
                type: string
          user:
            type: object
            properties:
              entity:
                type: object
                properties:
                  attributes:
                    type: object
                    properties:
                      Privileged:
                        description: Indicates if the user is privileged.
                        type: boolean
              is_privileged:
                description: Indicates if the user is privileged.
                type: boolean
              name:
                type: string
    Security_Entity_Analytics_API_EntityAnalyticsPrivileges:
      type: object
      properties:
        has_all_required:
          type: boolean
        has_install_permissions:
          type: boolean
        has_read_permissions:
          type: boolean
        has_write_permissions:
          type: boolean
        install_privileges:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail'
        privileges:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail'
      required:
      - has_all_required
      - privileges
    Security_Entity_Analytics_API_CreateAssetCriticalityRecord:
      allOf:
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
      - type: object
        properties:
          criticality_level:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
        required:
        - criticality_level
    Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem:
      type: object
      properties:
        index:
          type: integer
        message:
          type: string
      required:
      - message
      - index
    Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse:
      type: object
      properties:
        cleanup_successful:
          example: false
          type: boolean
        errors:
          items:
            type: object
            properties:
              error:
                type: string
              seq:
                type: integer
            required:
            - seq
            - error
          type: array
      required:
      - cleanup_successful
      - errors
    Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts:
      type: object
      properties:
        asset:
          type: object
          properties:
            criticality:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
          required:
          - asset
        entity:
          type: object
          properties:
            asset:
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
              required:
              - criticality
            id:
              type: string
          required:
          - id
        host:
          type: object
          properties:
            asset:
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
              required:
              - criticality
            name:
              type: string
          required:
          - name
        service:
          type: object
          properties:
            asset:
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
              required:
              - criticality
            name:
              type: string
          required:
          - name
        user:
          type: object
          properties:
            asset:
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
              required:
              - criticality
            name:
              type: string
          required:
          - name
      required:
      - asset
    Security_Entity_Analytics_API_PrivmonUserCsvUploadStats:
      type: object
      properties:
        failedOperations:
          type: integer
        successfulOperations:
          type: integer
        totalOperations:
          type: integer
        uploaded:
          type: integer
      required:
      - successfulOperations
      - uploaded
      - failedOperations
      - totalOperations
    Security_Entity_Analytics_API_RiskScoreInput:
      description: A generic representation of a document contributing to a Risk Score.
      type: object
      properties:
        category:
          description: The risk category of the risk input document.
          example: category_1
          type: string
        contribution_score:
          format: double
          type: number
        description:
          description: A human-readable description of the risk input document.
          example: 'Generated from Detection Engine Rule: Malware Prevention Alert'
          type: string
        entity_id:
          description: The EUID of the entity within the graph that generated this alert.
          type: string
        id:
          description: The unique identifier (`_id`) of the original source document
          example: 91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c
          type: string
        index:
          description: The unique index (`_index`) of the original source document
          example: .internal.alerts-security.alerts-default-000001
          type: string
        risk_score:
          description: The weighted risk score of the risk input document.
          format: double
          maximum: 100
          minimum: 0
          type: number
        timestamp:
          description: The @timestamp of the risk input document.
          example: '2017-07-21T17:32:28Z'
          type: string
      required:
      - id
      - index
      - description
      - category
    Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties:
      type: object
      properties:
        enabled:
          type: boolean
        filter:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_Filter'
        identifierField:
          description: Field used to query the entity store for index-type sources
          maxLength: 256
          type: string
        indexPattern:
          maxLength: 1000
          type: string
        integrationName:
          maxLength: 256
          type: string
        integrations:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_Integrations'
        matchers:
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_Matcher'
          maxItems: 100
          type: array
        name:
          maxLength: 256
          type: string
        queryRule:
          description: KQL query used to filter data from the provided index patterns
          maxLength: 4096
          type: string
        range:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_DateRange'
        type:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntitySourceType'
    Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus:
      description: The status of the Privilege Monitoring Engine
      enum:
      - started
      - error
      - disabled
      - not_installed
      type: string
    Security_Entity_Analytics_API_MonitoringEntitySourceProperties:
      allOf:
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties'
      - type: object
        properties:
          managed:
            type: boolean
    Security_Entity_Analytics_API_AssetCriticalityLevel:
      description: The criticality level of the asset.
      enum:
      - low_impact
      - medium_impact
      - high_impact
      - extreme_impact
      type: string
    Security_Entity_Analytics_API_RiskEngineScheduleNowResponse:
      type: object
      properties:
        success:
          type: boolean
    Security_Entity_Analytics_API_AssetCriticalityRecord:
      allOf:
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts'
      - type: object
        properties:
          '@timestamp':
            description: The time the record was created or updated.
            example: '2017-07-21T17:32:28Z'
            format: date-time
            type: string
        required:
        - '@timestamp'
      example:
        '@timestamp': '2024-08-02T11:15:34.290Z'
        asset:
          criticality: high_impact
        criticality_level: high_impact
        host:
          asset:
            criticality: high_impact
          name: my_host
        id_field: host.name
        id_value: my_host
    Security_Entity_Analytics_API_IdentifierType:
      enum:
      - host
      - user
      - service
      - generic
      type: string
    Security_Entity_Analytics_API_WatchlistObject:
      example:
        createdAt: '2026-01-28T12:00:00.000Z'
        description: High risk vendor watchlist
        id: watchlist-123
        managed: false
        name: High Risk Vendors
        riskModifier: 1.5
        updatedAt: '2026-02-18T12:00:00.000Z'
      type: object
      properties:
        createdAt:
          description: Timestamp indicating when the watchlist was created
          format: date-time
          type: string
        description:
          description: Description of the watchlist
          type: string
        entityCount:
          description: Number of entities in the watchlist
          type: number
        entitySourceIds:
          description: List of entity source IDs associated with the watchlist
          items:
            type: string
          type: array
        hasManualEntities:
          description: Indicates whether the watchlist contains manually assigned entities
          type: boolean
        id:
          description: The unique ID of the watchlist
          type: string
        managed:
          description: Indicates if the watchlist is managed by the system
          type: boolean
        name:
          description: The name of the watchlist
          type: string
        riskModifier:
          description: Risk score modifier associated with the watchlist
          type: number
        updatedAt:
          description: Timestamp indicating when the watchlist was last updated
          format: date-time
          type: string
      required:
      - name
      - riskModifier
      - managed
    Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail:
      type: object
      properties:
        elasticsearch:
          type: object
          properties:
            cluster:
              additionalProperties:
                type: boolean
              type: object
            index:
              additionalProperties:
                additionalProperties:
                  type: boolean
                type: object
              type: object
        kibana:
          additionalProperties:
            type: boolean
          type: object
      required:
      - elasticsearch
    Security_Entity_Analytics_API_MonitoringEntitySource:
      allOf:
      - $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySourceProperties'
      - type: object
        properties:
          apiKeyId:
            description: ID of the API key used for scoped reads from the source index. Only present for index-type sources.
            maxLength: 64
            type:
            - string
            - 'null'
          id:
            type: string
        required:
        - type
        - name
        - id
        - managed
    Security_Entity_Analytics_API_RiskScoreModifier:
      description: A modifier that was applied to the risk score calculation.
      type: object
      properties:
        contribution:
          format: double
          type: number
        metadata:
          additionalProperties: true
          type: object
        modifier_value:
          format: double
          type: number
        subtype:
          maxLength: 100
          type: string
        type:
          maxLength: 100
          type: string
      required:
      - type
      - contribution
    Security_Entity_Analytics_API_Matcher:
      type: object
      properties:
        fields:
          items:
            maxLength: 256
            type: string
          maxItems: 100
          type: array
        values:
          description: 'Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.

            '
          oneOf:
          - items:
              maxLength: 256
              type: string
            maxItems: 1000
            type: array
          - items:
              type: boolean
            maxItems: 1000
            type: array
      required:
      - fields
      - values
    Security_Entity_Analytics_API_MonitoredUserUpdateDoc:
      type: object
      properties:
        entity_analytics_monitoring:
          type: object
          properties:
            labels:
              items:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringLabel'
              type: array
        id:
          maxLength: 256
          type: string
        labels:
          type: object
          properties:
            source_ids:
              items:
                maxLength: 256
                type: string
              maxItems: 100
              type: array
            source_integrations:
              items:
                maxLength: 256
                type: string
              maxItems: 100
              type: array
            sources:
              items:
                enum:
                - csv
                - index_sync
                - api
              maxItems: 100
              type: array
        user:
          type: object
          properties:
            is_privileged:
              description: Indicates if the user is privileged.
              type: boolean
            name:
              maxLength: 512
              type: string
    Security_Entity_Analytics_API_MonitoringLabel:
      type: object
      properties:
        field:
          maxLength: 256
          type: string
        source:
          type: string
        value:
          maxLength: 256
          type: string
      required:
      - field
      - value
      - source
    Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem:
      example:
        matchedEntities: 1
        status: success
      type: object
      properties:
        error:
          description: Error message if the row failed to process
          example: Invalid entity type
          type: string
        matchedEntities:
          description: Number of entities matched for this row
          example: 1
          type: integer
        status:
          enum:
          - success
          - failure
          - unmatched
          example: success
          type: string
      required:
      - status
      - matchedEntities
    Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload:
      description: The criticality level of the asset for bulk upload. The value `unassigned` is used to indicate that the criticality level is not assigned and is only used for bulk upload.
      enum:
      - low_impact
      - medium_impact
      - high_impact
      - extreme_impact
      - unassigned
      type: string
    Security_Entity_Analytics_API_EntityRiskLevels:
      enum:
      - Unknown
      - Low
      - Moderate
      - High
      - Critical
      type: string
    Security_Entity_Analytics_API_AssetCriticalityRecordIdParts:
      type: object
      properties:
        id_field:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
          description: The field representing the ID.
          example: host.name
        id_value:
          description: The ID value of the asset.
          type: string
      required:
      - id_value
      - id_field
    Security_Entity_Analytics_API_TaskManagerUnavailableResponse:
      description: Task manager is unavailable
      type: object
      properties:
        message:
          type: string
        status_code:
          minimum: 400
          type: integer
      required:
      - status_code
      - message
    Security_Entity_Analytics_API_RiskScoreHistoryEntry:
      type: object
      properties:
        '@timestamp':
          format: date-time
          maxLength: 33
          type: string
        calculated_level:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskLevels'
        calculated_score:
          format: double
          type: number
        calculated_score_norm:
          format: double
          maximum: 100
          minimum: 0
          type: number
        category_1_count:
          type: integer
        category_1_score:
          format: double
          type: number
        category_2_count:
          type: integer
        category_2_score:
          format: double
          type: number
        criticality_level:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
        inputs:
          description: Present only when requested with `include_contributions=true`.
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreInput'
          type: array
        modifiers:
          description: Present only when requested with `include_contributions=true`.
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreModifier'
          type: array
        score_type:
          enum:
          - base
          - propagated
          - resolution
          type: string
      required:
      - '@timestamp'
      - calculated_score_norm
      - calculated_level
    Security_Entity_Analytics_API_DateRange:
      description: Defines the lookback period for filtering source data by timestamp.
      type: object
      properties:
        end:
          description: End of the lookback period (date math or ISO string, e.g. "now")
          maxLength: 256
          type: string
        start:
          description: Start of the lookback period (date math or ISO string, e.g. "now-10d")
          maxLength: 256
          type: string
      required:
      - start
      - end
    Security_Entity_Analytics_API_RiskScoreHistoryResponse:
      type: object
      properties:
        entity_id:
          maxLength: 1000
          type: string
        entity_type:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdentifierType'
        entries:
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryEntry'
          type: array
        interval:
          description: The effective Elasticsearch `date_histogram` interval expression the entries were aggregated into (for example `3h`, `1d`, `1w`), derived from the requested time range.
          maxLength: 10
          type: string
      required:
      - entity_id
      - entity_type
      - interval
      - entries
    Security_Entity_Analytics_API_MonitoringEngineDescriptor:
      type: object
      properties:
        error:
          type: object
          properties:
            message:
              description: Error message typically only present if the engine is in error state
              type: string
        status:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus'
      required:
      - status
    Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats:
      type: object
      properties:
        failed:
          type: integer
        successful:
          type: integer
        total:
          type: integer
      required:
      - successful
      - failed
      - total
    Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse:
      type: object
      properties:
        errors:
          items:
            type: object
            properties:
              error:
                type: string
              seq:
                type: integer
            required:
            - seq
            - error
          type: array
        risk_engine_saved_object_configured:
          example: false
          type: boolean
      required:
      - risk_engine_saved_object_configured
      - errors
    Security_Entity_Analytics_API_UserName:
      type: object
      properties:
        entity_analytics_monitoring:
          description: Entity analytics monitoring configuration for the user
          type: object
          properties:
            labels:
              description: Array of labels associated with the user
              items:
                type: object
                properties:
                  field:
                    description: The field name for the label
                    maxLength: 256
                    type: string
                  source:
                    description: The source where this label was created (api, csv, or index_sync)
                    enum:
                    - api
                    - csv
                    - index_sync
                    type: string
                  value:
                    description: The value of the label
                    maxLength: 256
                    type: string
              maxItems: 100
              type: array
        user:
          type: object
          properties:
            name:
              description: The name of the user.
              maxLength: 512
              type: string
    Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem:
      type: object
      properties:
        index:
          type:
          - integer
          - 'null'
        message:
          type: string
        username:
          type:
          - string
          - 'null'
      required:
      - message
      - index
      - username
    Security_Entity_Analytics_API_Integrations:
      type: object
      properties:
        syncData:
          description: integrations latest full sync and update syncData
          type: object
          properties:
            lastFullSync:
              description: Timestamp of the last full sync from integrations
              format: date-time
              type: string
            lastUpdateProcessed:
              description: Timestamp of the last update processed from integrations
              format: date-time
              type: string
        syncMarkerIndex:
          description: Index to read latest sync markers from
          maxLength: 1000
          type: string
    Security_Entity_Analytics_API_IdField:
      enum:
      - host.name
      - user.name
      - service.name
      - entity.id
      type: string
    Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse:
      type: object
      properties:
        full_error:
          type: string
        message:
          type: string
      required:
      - message
      - full_error
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"