---
type: api
title: Create an entity
description: Create a new entity record in the Entity Store for the specified entity type.<br/><br/>[Required authorization] Route required privileges: securitySolution.
url: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-post-security-entity-store-entities-entitytype
resource: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-post-security-entity-store-entities-entitytype
products:
  - Kibana
---

# Create an entity

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/security/entity_store/entities/{entityType}`
- `POST` `/s/{space_id}/api/security/entity_store/entities/{entityType}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `entityType` (enum) — required
  The entity type to create.
  Values: `user`, `host`, `service`, `generic`

## Description

Create a new entity record in the Entity Store for the specified entity type.

## Required privileges

- Privileges: `securitySolution`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

Any of:
- **{ user }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `tags` (string[]) — optional
    Tags attached to the entity.
  - `user` (object) — optional
    Elastic Common Schema (ECS) user fields collected on the entity.
    - `domain` (string[]) — optional
      Observed user domains.
    - `email` (string[]) — optional
      Observed email addresses.
    - `full_name` (string[]) — optional
      Observed full names of the user.
    - `hash` (string[]) — optional
      Observed user hashes.
    - `id` (string[]) — optional
      Observed user identifiers.
    - `name` (string) — optional
      Primary user name.
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `roles` (string[]) — optional
      Observed roles assigned to the user.
- **{ host }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `host` (object) — optional
    Elastic Common Schema (ECS) host fields collected on the entity.
    - `architecture` (string[]) — optional
      Observed CPU architectures.
    - `domain` (string[]) — optional
      Observed host domains.
    - `hostname` (string[]) — optional
      Observed hostnames.
    - `id` (string[]) — optional
      Observed host identifiers.
    - `ip` (string[]) — optional
      Observed IP addresses.
    - `mac` (string[]) — optional
      Observed MAC addresses.
    - `name` (string) — optional
      Primary host name.
    - `os` (object) — optional
      Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
      - `family` (string) — optional
      - `full` (string) — optional
      - `kernel` (string) — optional
      - `name` (union string | string[]) — optional
      - `platform` (string) — optional
      - `type` (union string | string[]) — optional
      - `version` (string) — optional
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `type` (string[]) — optional
      Observed host types.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `tags` (string[]) — optional
    Tags attached to the entity.
- **{ service }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `service` (object) — optional
    Elastic Common Schema (ECS) service fields collected on the entity.
    - `address` (string) — optional
      Service address.
    - `environment` (string) — optional
      Service environment (for example, production, staging).
    - `ephemeral_id` (string) — optional
      Ephemeral identifier of the service.
    - `id` (string) — optional
      Unique identifier of the service.
    - `name` (string) — optional
      Primary service name.
    - `node` (object) — optional
      Node information for the service.
      - `name` (string) — optional
        Node name.
      - `role` (string) — optional
        Node role.
      - `roles` (string[]) — optional
        Node roles.
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `state` (string) — optional
      Current state of the service.
    - `type` (string) — optional
      Service type.
    - `version` (string) — optional
      Service version.
  - `tags` (string[]) — optional
    Tags attached to the entity.
- **{ cloud, orchestrator }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `cloud` (object) — optional
    Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
    - `account` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `availability_zone` (string) — optional
    - `instance` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `machine` (object) — optional
      - `type` (string) — optional
    - `project` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `provider` (string) — optional
    - `region` (string) — optional
    - `service` (object) — optional
      - `name` (string) — optional
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
  - `labels` (map string to object) — optional
  - `orchestrator` (object) — optional
    Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
    - `api_version` (string) — optional
    - `cluster` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
      - `url` (string) — optional
      - `version` (string) — optional
    - `namespace` (string) — optional
    - `organization` (string) — optional
    - `resource` (object) — optional
      - `annotation` (string) — optional
      - `id` (string) — optional
      - `ip` (string) — optional
      - `label` (string) — optional
      - `name` (string) — optional
      - `parent` (object) — optional
        - `type` (string) — optional
      - `type` (string) — optional
    - `type` (string) — optional
  - `tags` (string[]) — optional

## Responses

#### `200`

Indicates the entity was successfully created.

`application/json`

#### `400`

Bad request.

`application/json`

#### `409`

Conflict.

`application/json`

## Code examples

#### Console

```console
POST kbn://api/security/entity_store/entities/host
{
  "entity": {
    "id": "host:web-server-prod-01",
    "name": "web-server-prod-01",
    "type": "host",
    "source": ["manual"],
    "attributes": { "asset": true }
  },
  "host": {
    "name": "web-server-prod-01",
    "ip": ["10.0.1.42"]
  }
}
```

#### curl

```curl
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","source":["manual"],"attributes":{"asset":true}},"host":{"name":"web-server-prod-01","ip":["10.0.1.42"]}}' \
  "${KIBANA_URL}/api/security/entity_store/entities/host"
```

## Response examples

#### Entity created

`application/json`

The entity record was successfully created in the Entity Store.

```json
{
  "ok": true
}
```

#### Entity identifier mismatch

`application/json`

The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.

```json
{
  "error": "Bad Request",
  "message": "Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01",
  "statusCode": 400
}
```

#### Entity already exists

`application/json`

An entity with the specified identifier already exists.

```json
{
  "error": "Conflict",
  "message": "Entity ID \u0027host:web-server-prod-01\u0027 already exists",
  "statusCode": 409
}
```