---
type: api
title: Manually unassign entities from a watchlist
description: Unassigns the provided entities from the specified watchlist.
url: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-unassignwatchlistentities
resource: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-unassignwatchlistentities
products:
  - Kibana
---

# Manually unassign entities from a watchlist

Authentication: required

Availability: Preview since 9.4

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign`
- `POST` `/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `watchlist_id` (string) — required
  The ID of the watchlist to remove entities from
  Example: `high-risk-vendors`

## Description

Unassigns the provided entities from the specified watchlist.
This only removes the "manual" assignment. If the entity is also
assigned via other sources (for example, index or integration), it will
remain on the watchlist.

## Request body

`application/json`

- `euids` (string[]) — required
  The EUIDs of the entities to unassign

## Response

Unassignment successful

`application/json`

- `failed` (integer)
  Number of entities that failed to process
- `items` (object[])
  - `error` (string)
    Error message if the entity failed to process
  - `euid` (string)
    The EUID of the entity
  - `status` (enum)
    Values: `success`, `failure`, `not_found`
- `not_found` (integer)
  Number of entities not found in the manual watchlist assignment
- `successful` (integer)
  Number of entities successfully unassigned
- `total` (integer)
  Total number of entities processed
## Code examples

#### Console

```console
POST kbn:/api/entity_analytics/watchlists/high-risk-vendors/entities/unassign
{
  "euids": [
    "user:john.doe",
    "host:web-01"
  ]
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/entity_analytics/watchlists/high-risk-vendors/entities/unassign" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "euids": [
      "user:john.doe",
      "host:web-01"
    ]
  }'
```

## Response examples

#### Successful unassignment of two entities

`application/json`

```json
{
  "failed": 0,
  "items": [
    {
      "euid": "user:john.doe",
      "status": "success"
    },
    {
      "euid": "host:web-01",
      "status": "not_found"
    }
  ],
  "not_found": 1,
  "successful": 1,
  "total": 2
}
```