Delete an entity

Base URL: https://{kibana_url}

DELETE /api/security/entity_store/entities
DELETE /s/{space_id}/api/security/entity_store/entities

Auth

Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.

Required privileges

Privileges securitySolution

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

entityId string required: The identifier of the entity to delete.

Responses

200

Indicates the entity was successfully deleted.

application/json

404

Entity not found.

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Delete a single entity from the Entity Store using its entity identifier.

Console Kibana Dev Tools

DELETE kbn://api/security/entity_store/entities/
{
  "entityId": "host:web-server-prod-01"
}

curl Shell

curl -X DELETE -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entityId":"host:web-server-prod-01"}' \
  "${KIBANA_URL}/api/security/entity_store/entities/"

Response

The entity was found and successfully removed from the latest index.

{
  "deleted": true
}

{
  "error": "Not Found",
  "message": "Entity ID \u0027host:web-server-prod-01\u0027 not found",
  "statusCode": 404
}