Update an entity
Base URL
https://{kibana_url}
Auth
Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the force query parameter to true to update protected fields.
Privileges
securitySolution
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
entityType
enum required
The entity type to update.
Values:
user
host
service
generic
force
union enum | boolean · default: false
When true, allows updating protected fields.
Values:
true
false
A required header to protect against CSRF attacks
Any of:
user
host
service
cloud, orchestrator
−
Hide 7 properties
@timestamp
string · format: date-time · max length: 64
The time the entity record was last updated.
asset
object
+
Show 9 properties
business_unit
string
Business unit the asset belongs to.
criticality
enum nullable
The criticality level assigned to this asset.
Values:
low_impact
medium_impact
high_impact
extreme_impact
environment
string
Deployment environment (for example, production, staging).
id
string
Unique identifier for the asset.
model
string
Model name or number.
name
string
Human-readable asset name.
owner
string
The owner of the asset.
serial_number
string
Serial number of the asset.
vendor
string
Vendor or manufacturer.
entity
object
+
Show 14 properties
attributes
object
Boolean flags describing characteristics of the entity.
+
Show 8 properties
asset
boolean
Whether the entity is classified as an asset.
known_redirects
string []
Known redirect URIs or URLs (e.g. OAuth application callbacks).
managed
boolean
Whether the entity is managed (for example, via a directory service).
mfa_enabled
boolean
Whether multi-factor authentication is enabled for the entity.
oauth_consent_restriction
string
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
permissions
string []
Action-level permissions granted to this entity (not roles or groups).
storage_class
string
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
watchlists
string []
Watchlist identifiers the entity belongs to (v2).
behaviors
object
Behavioral signals observed for the entity.
+
Show 2 properties
anomaly_job_ids
string []
Machine learning anomaly job identifiers (v2).
rule_names
string []
Detection rule names that flagged this entity (v2).
created_by
string
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
EngineMetadata
object
+
Show 1 property
id
string
Unique identifier for this entity.
lifecycle
object
Timestamps tracking the entity lifecycle.
+
Show 3 properties
first_seen
string · format: date-time · max length: 64
When the entity was first observed.
last_activity
string · format: date-time · max length: 64
When the entity last generated activity.
last_seen
string · format: date-time · max length: 64
When the entity was last observed.
name
string
Human-readable name of the entity.
relationships
object
Connections between this entity and other entities.
+
Show 9 properties
accesses_frequently
object
Entities this entity accesses frequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
accesses_infrequently
object
Entities this entity accesses infrequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
administers
object
Entities this entity administers (for example, a user who is an admin of a service).
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
communicates_with
object
Entities this entity communicates with.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
depends_on
object
Entities this entity depends on.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns
object
Entities owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns_inferred
object
Entities inferred to be owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
resolution
object
Resolution metadata linking this entity to another.
+
Show 2 properties
resolved_to
string
entity.id of the entity this one resolves to
risk
object
Aggregated risk score for the resolution group.
+
Show 3 properties
calculated_level
enum
Lexical description of the resolution group's aggregated risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the resolution group's aggregated risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the resolution group's aggregated risk score.
supervises
object
Entities supervised by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
risk
object
Risk scoring information for the entity.
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
schema_version
string
Schema version of the entity record.
source
string []
Sources that produced this entity record.
sub_type
string
Optional sub-type classification for the entity.
type
string
The entity type.
url
string
URL associated with the entity.
event
object
+
Show 1 property
ingested
string · format: date-time · max length: 64
When the event was ingested into Elasticsearch.
labels
map string to object
Custom key-value labels attached to the entity.
tags
string []
Tags attached to the entity.
user
object
Elastic Common Schema (ECS) user fields collected on the entity.
+
Show 8 properties
domain
string []
Observed user domains.
email
string []
Observed email addresses.
full_name
string []
Observed full names of the user.
hash
string []
Observed user hashes.
id
string []
Observed user identifiers.
name
string
Primary user name.
risk
object
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score.
roles
string []
Observed roles assigned to the user.
−
Hide 7 properties
@timestamp
string · format: date-time · max length: 64
The time the entity record was last updated.
asset
object
+
Show 9 properties
business_unit
string
Business unit the asset belongs to.
criticality
enum nullable
The criticality level assigned to this asset.
Values:
low_impact
medium_impact
high_impact
extreme_impact
environment
string
Deployment environment (for example, production, staging).
id
string
Unique identifier for the asset.
model
string
Model name or number.
name
string
Human-readable asset name.
owner
string
The owner of the asset.
serial_number
string
Serial number of the asset.
vendor
string
Vendor or manufacturer.
entity
object
+
Show 14 properties
attributes
object
Boolean flags describing characteristics of the entity.
+
Show 8 properties
asset
boolean
Whether the entity is classified as an asset.
known_redirects
string []
Known redirect URIs or URLs (e.g. OAuth application callbacks).
managed
boolean
Whether the entity is managed (for example, via a directory service).
mfa_enabled
boolean
Whether multi-factor authentication is enabled for the entity.
oauth_consent_restriction
string
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
permissions
string []
Action-level permissions granted to this entity (not roles or groups).
storage_class
string
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
watchlists
string []
Watchlist identifiers the entity belongs to (v2).
behaviors
object
Behavioral signals observed for the entity.
+
Show 2 properties
anomaly_job_ids
string []
Machine learning anomaly job identifiers (v2).
rule_names
string []
Detection rule names that flagged this entity (v2).
created_by
string
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
EngineMetadata
object
+
Show 1 property
id
string
Unique identifier for this entity.
lifecycle
object
Timestamps tracking the entity lifecycle.
+
Show 3 properties
first_seen
string · format: date-time · max length: 64
When the entity was first observed.
last_activity
string · format: date-time · max length: 64
When the entity last generated activity.
last_seen
string · format: date-time · max length: 64
When the entity was last observed.
name
string
Human-readable name of the entity.
relationships
object
Connections between this entity and other entities.
+
Show 9 properties
accesses_frequently
object
Entities this entity accesses frequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
accesses_infrequently
object
Entities this entity accesses infrequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
administers
object
Entities this entity administers (for example, a user who is an admin of a service).
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
communicates_with
object
Entities this entity communicates with.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
depends_on
object
Entities this entity depends on.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns
object
Entities owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns_inferred
object
Entities inferred to be owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
resolution
object
Resolution metadata linking this entity to another.
+
Show 2 properties
resolved_to
string
entity.id of the entity this one resolves to
risk
object
Aggregated risk score for the resolution group.
+
Show 3 properties
calculated_level
enum
Lexical description of the resolution group's aggregated risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the resolution group's aggregated risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the resolution group's aggregated risk score.
supervises
object
Entities supervised by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
risk
object
Risk scoring information for the entity.
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
schema_version
string
Schema version of the entity record.
source
string []
Sources that produced this entity record.
sub_type
string
Optional sub-type classification for the entity.
type
string
The entity type.
url
string
URL associated with the entity.
event
object
+
Show 1 property
ingested
string · format: date-time · max length: 64
When the event was ingested into Elasticsearch.
host
object
Elastic Common Schema (ECS) host fields collected on the entity.
+
Show 10 properties
architecture
string []
Observed CPU architectures.
domain
string []
Observed host domains.
hostname
string []
Observed hostnames.
id
string []
Observed host identifiers.
ip
string []
Observed IP addresses.
mac
string []
Observed MAC addresses.
name
string
Primary host name.
os
object
Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
+
Show 7 properties
name
union string | string []
type
union string | string []
risk
object
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score.
type
string []
Observed host types.
labels
map string to object
Custom key-value labels attached to the entity.
tags
string []
Tags attached to the entity.
−
Hide 7 properties
@timestamp
string · format: date-time · max length: 64
The time the entity record was last updated.
asset
object
+
Show 9 properties
business_unit
string
Business unit the asset belongs to.
criticality
enum nullable
The criticality level assigned to this asset.
Values:
low_impact
medium_impact
high_impact
extreme_impact
environment
string
Deployment environment (for example, production, staging).
id
string
Unique identifier for the asset.
model
string
Model name or number.
name
string
Human-readable asset name.
owner
string
The owner of the asset.
serial_number
string
Serial number of the asset.
vendor
string
Vendor or manufacturer.
entity
object
+
Show 14 properties
attributes
object
Boolean flags describing characteristics of the entity.
+
Show 8 properties
asset
boolean
Whether the entity is classified as an asset.
known_redirects
string []
Known redirect URIs or URLs (e.g. OAuth application callbacks).
managed
boolean
Whether the entity is managed (for example, via a directory service).
mfa_enabled
boolean
Whether multi-factor authentication is enabled for the entity.
oauth_consent_restriction
string
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
permissions
string []
Action-level permissions granted to this entity (not roles or groups).
storage_class
string
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
watchlists
string []
Watchlist identifiers the entity belongs to (v2).
behaviors
object
Behavioral signals observed for the entity.
+
Show 2 properties
anomaly_job_ids
string []
Machine learning anomaly job identifiers (v2).
rule_names
string []
Detection rule names that flagged this entity (v2).
created_by
string
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
EngineMetadata
object
+
Show 1 property
id
string
Unique identifier for this entity.
lifecycle
object
Timestamps tracking the entity lifecycle.
+
Show 3 properties
first_seen
string · format: date-time · max length: 64
When the entity was first observed.
last_activity
string · format: date-time · max length: 64
When the entity last generated activity.
last_seen
string · format: date-time · max length: 64
When the entity was last observed.
name
string
Human-readable name of the entity.
relationships
object
Connections between this entity and other entities.
+
Show 9 properties
accesses_frequently
object
Entities this entity accesses frequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
accesses_infrequently
object
Entities this entity accesses infrequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
administers
object
Entities this entity administers (for example, a user who is an admin of a service).
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
communicates_with
object
Entities this entity communicates with.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
depends_on
object
Entities this entity depends on.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns
object
Entities owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns_inferred
object
Entities inferred to be owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
resolution
object
Resolution metadata linking this entity to another.
+
Show 2 properties
resolved_to
string
entity.id of the entity this one resolves to
risk
object
Aggregated risk score for the resolution group.
+
Show 3 properties
calculated_level
enum
Lexical description of the resolution group's aggregated risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the resolution group's aggregated risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the resolution group's aggregated risk score.
supervises
object
Entities supervised by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
risk
object
Risk scoring information for the entity.
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
schema_version
string
Schema version of the entity record.
source
string []
Sources that produced this entity record.
sub_type
string
Optional sub-type classification for the entity.
type
string
The entity type.
url
string
URL associated with the entity.
event
object
+
Show 1 property
ingested
string · format: date-time · max length: 64
When the event was ingested into Elasticsearch.
labels
map string to object
Custom key-value labels attached to the entity.
service
object
Elastic Common Schema (ECS) service fields collected on the entity.
+
Show 10 properties
address
string
Service address.
environment
string
Service environment (for example, production, staging).
ephemeral_id
string
Ephemeral identifier of the service.
id
string
Unique identifier of the service.
name
string
Primary service name.
node
object
Node information for the service.
+
Show 3 properties
roles
string []
Node roles.
risk
object
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score.
state
string
Current state of the service.
type
string
Service type.
version
string
Service version.
tags
string []
Tags attached to the entity.
−
Hide 8 properties
@timestamp
string · format: date-time · max length: 64
The time the entity record was last updated.
asset
object
+
Show 9 properties
business_unit
string
Business unit the asset belongs to.
criticality
enum nullable
The criticality level assigned to this asset.
Values:
low_impact
medium_impact
high_impact
extreme_impact
environment
string
Deployment environment (for example, production, staging).
id
string
Unique identifier for the asset.
model
string
Model name or number.
name
string
Human-readable asset name.
owner
string
The owner of the asset.
serial_number
string
Serial number of the asset.
vendor
string
Vendor or manufacturer.
cloud
object
Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
+
Show 8 properties
account
object
+
Show 2 properties
instance
object
+
Show 2 properties
machine
object
+
Show 1 property
project
object
+
Show 2 properties
service
object
+
Show 1 property
entity
object
+
Show 14 properties
attributes
object
Boolean flags describing characteristics of the entity.
+
Show 8 properties
asset
boolean
Whether the entity is classified as an asset.
known_redirects
string []
Known redirect URIs or URLs (e.g. OAuth application callbacks).
managed
boolean
Whether the entity is managed (for example, via a directory service).
mfa_enabled
boolean
Whether multi-factor authentication is enabled for the entity.
oauth_consent_restriction
string
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
permissions
string []
Action-level permissions granted to this entity (not roles or groups).
storage_class
string
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
watchlists
string []
Watchlist identifiers the entity belongs to (v2).
behaviors
object
Behavioral signals observed for the entity.
+
Show 2 properties
anomaly_job_ids
string []
Machine learning anomaly job identifiers (v2).
rule_names
string []
Detection rule names that flagged this entity (v2).
created_by
string
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
EngineMetadata
object
+
Show 1 property
id
string
Unique identifier for this entity.
lifecycle
object
Timestamps tracking the entity lifecycle.
+
Show 3 properties
first_seen
string · format: date-time · max length: 64
When the entity was first observed.
last_activity
string · format: date-time · max length: 64
When the entity last generated activity.
last_seen
string · format: date-time · max length: 64
When the entity was last observed.
name
string
Human-readable name of the entity.
relationships
object
Connections between this entity and other entities.
+
Show 9 properties
accesses_frequently
object
Entities this entity accesses frequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
accesses_infrequently
object
Entities this entity accesses infrequently.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
administers
object
Entities this entity administers (for example, a user who is an admin of a service).
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
communicates_with
object
Entities this entity communicates with.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
depends_on
object
Entities this entity depends on.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns
object
Entities owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
owns_inferred
object
Entities inferred to be owned by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
resolution
object
Resolution metadata linking this entity to another.
+
Show 2 properties
resolved_to
string
entity.id of the entity this one resolves to
risk
object
Aggregated risk score for the resolution group.
+
Show 3 properties
calculated_level
enum
Lexical description of the resolution group's aggregated risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the resolution group's aggregated risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the resolution group's aggregated risk score.
supervises
object
Entities supervised by this entity.
+
Show 2 properties
ids
string []
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
raw_identifiers
object
+
Show 7 properties
risk
object
Risk scoring information for the entity.
+
Show 3 properties
calculated_level
enum
Lexical description of the entity's risk.
Values:
Unknown
Low
Moderate
High
Critical
calculated_score
number
The raw numeric value of the given entity's risk score.
calculated_score_norm
number · min: 0 · max: 100
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
schema_version
string
Schema version of the entity record.
source
string []
Sources that produced this entity record.
sub_type
string
Optional sub-type classification for the entity.
type
string
The entity type.
url
string
URL associated with the entity.
event
object
+
Show 1 property
ingested
string · format: date-time · max length: 64
labels
map string to object
orchestrator
object
Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
+
Show 6 properties
cluster
object
+
Show 4 properties
resource
object
+
Show 7 properties
parent
object
+
Show 1 property
200
Indicates the entity was successfully updated.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Update entity attributes
languages
Request
Console
1 / 2 languages
‹
›
1
2
3
4
5
6
7
8
9
10
PUT kbn://api/security/entity_store/entities/user?force=true
{
"entity": {
"id": "user:jane.doe@example.com",
"name": "jane.doe",
"type": "user",
"attributes": { "managed": true, "mfa_enabled": true }
},
"user": { "name": "jane.doe" }
}
1
2
3
4
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"entity":{"id":"user:jane.doe@example.com","name":"jane.doe","type":"user","attributes":{"managed":true,"mfa_enabled":true}},"user":{"name":"jane.doe"}}' \
"${KIBANA_URL}/api/security/entity_store/entities/user?force=true"
Response
The request attempts to update protected fields without the force query parameter.
Show more
No entity with the specified identifier exists.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity ID \u0027user:jane.doe@example.com\u0027 not found",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter.
Show more
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
PUT kbn:/api/security/entity_store/entities/ENTITY_TYPE
{
"entity": {
"attributes": {
"managed": true,
"mfa_enabled": true
},
"id": "user:jane.doe@example.com",
"lifecycle": {
"last_activity": "2026-04-10T14:30:00.000Z"
},
"name": "jane.doe",
"type": "user"
},
"user": {
"email": [
"jane.doe@example.com"
],
"name": "jane.doe",
"roles": [
"admin",
"analyst"
]
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"entity": {
"attributes": {
"managed": true,
"mfa_enabled": true
},
"id": "user:jane.doe@example.com",
"lifecycle": {
"last_activity": "2026-04-10T14:30:00.000Z"
},
"name": "jane.doe",
"type": "user"
},
"user": {
"email": [
"jane.doe@example.com"
],
"name": "jane.doe",
"roles": [
"admin",
"analyst"
]
}
}' \
"${KIBANA_URL}/api/security/entity_store/entities/${ENTITY_TYPE}"
Generated from the API spec
Response
The entity record was successfully updated.
Show more
The request attempts to update protected fields without the force query parameter.
Show more
No entity with the specified identifier exists.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity ID \u0027user:jane.doe@example.com\u0027 not found",
"statusCode": 404
}