List all monitored users

Base URL: https://{kibana_url}

GET /api/entity_analytics/monitoring/users/list
GET /s/{space_id}/api/entity_analytics/monitoring/users/list

Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

kql string: KQL query to filter the list of monitored users

Response

List of monitored users

application/json

<array> object[]

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/entity_analytics/monitoring/users/list

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/entity_analytics/monitoring/users/list" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

[
  {
    "@timestamp": "2026-01-28T12:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "IT"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-28T12:00:00.000Z"
    },
    "id": "user-abc-123",
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  },
  {
    "@timestamp": "2026-01-15T09:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "csv",
          "value": "Security"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-15T09:00:00.000Z"
    },
    "id": "user-def-456",
    "user": {
      "is_privileged": true,
      "name": "jane.smith"
    }
  }
]