Upsert multiple monitored users via CSV upload

Base URL: https://{kibana_url}

POST /api/entity_analytics/monitoring/users/_csv
POST /s/{space_id}/api/entity_analytics/monitoring/users/_csv

Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Bulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

file string · format: binary required: The CSV file to upload.

Responses

Bulk upload successful

application/json

errors object[] required
stats object required

413

File too large

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/entity_analytics/monitoring/users/_csv
{
  "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/entity_analytics/monitoring/users/_csv" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: multipart/form-data" \
  -d '{
    "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
  }'

Generated from the API spec

Response

{
  "errors": [
    {
      "index": 1,
      "message": "Invalid monitored field",
      "username": "john.doe"
    }
  ],
  "stats": {
    "failedOperations": 1,
    "successfulOperations": 1,
    "totalOperations": 2,
    "uploaded": 2
  }
}