---
type: api
title: Update an entity
description: Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.<br/><br/>[Required authorization] Route required privileges: securitySolution.
url: https://www.elastic.co/docs/api/doc/kibana/operation/operation-put-security-entity-store-entities-entitytype
resource: https://www.elastic.co/docs/api/doc/kibana/operation/operation-put-security-entity-store-entities-entitytype
products:
  - Kibana
---

# Update an entity

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/security/entity_store/entities/{entityType}`
- `PUT` `/s/{space_id}/api/security/entity_store/entities/{entityType}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `entityType` (enum) — required
  The entity type to update.
  Values: `user`, `host`, `service`, `generic`

## Description

Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.

## Required privileges

- Privileges: `securitySolution`

## Query string parameters

- `force` (union enum | boolean · default: false) — optional
  When true, allows updating protected fields.
  Values: `true`, `false`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

Any of:
- **{ user }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `tags` (string[]) — optional
    Tags attached to the entity.
  - `user` (object) — optional
    Elastic Common Schema (ECS) user fields collected on the entity.
    - `domain` (string[]) — optional
      Observed user domains.
    - `email` (string[]) — optional
      Observed email addresses.
    - `full_name` (string[]) — optional
      Observed full names of the user.
    - `hash` (string[]) — optional
      Observed user hashes.
    - `id` (string[]) — optional
      Observed user identifiers.
    - `name` (string) — optional
      Primary user name.
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `roles` (string[]) — optional
      Observed roles assigned to the user.
- **{ host }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `host` (object) — optional
    Elastic Common Schema (ECS) host fields collected on the entity.
    - `architecture` (string[]) — optional
      Observed CPU architectures.
    - `domain` (string[]) — optional
      Observed host domains.
    - `hostname` (string[]) — optional
      Observed hostnames.
    - `id` (string[]) — optional
      Observed host identifiers.
    - `ip` (string[]) — optional
      Observed IP addresses.
    - `mac` (string[]) — optional
      Observed MAC addresses.
    - `name` (string) — optional
      Primary host name.
    - `os` (object) — optional
      Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
      - `family` (string) — optional
      - `full` (string) — optional
      - `kernel` (string) — optional
      - `name` (union string | string[]) — optional
      - `platform` (string) — optional
      - `type` (union string | string[]) — optional
      - `version` (string) — optional
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `type` (string[]) — optional
      Observed host types.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `tags` (string[]) — optional
    Tags attached to the entity.
- **{ service }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
      When the event was ingested into Elasticsearch.
  - `labels` (map string to object) — optional
    Custom key-value labels attached to the entity.
  - `service` (object) — optional
    Elastic Common Schema (ECS) service fields collected on the entity.
    - `address` (string) — optional
      Service address.
    - `environment` (string) — optional
      Service environment (for example, production, staging).
    - `ephemeral_id` (string) — optional
      Ephemeral identifier of the service.
    - `id` (string) — optional
      Unique identifier of the service.
    - `name` (string) — optional
      Primary service name.
    - `node` (object) — optional
      Node information for the service.
      - `name` (string) — optional
        Node name.
      - `role` (string) — optional
        Node role.
      - `roles` (string[]) — optional
        Node roles.
    - `risk` (object) — optional
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score.
    - `state` (string) — optional
      Current state of the service.
    - `type` (string) — optional
      Service type.
    - `version` (string) — optional
      Service version.
  - `tags` (string[]) — optional
    Tags attached to the entity.
- **{ cloud, orchestrator }**
  - `@timestamp` (string · format: date-time · max length: 64) — optional
    The time the entity record was last updated.
  - `asset` (object) — optional
    - `business_unit` (string) — optional
      Business unit the asset belongs to.
    - `criticality` (enum) — optional — nullable
      The criticality level assigned to this asset.
      Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
    - `environment` (string) — optional
      Deployment environment (for example, production, staging).
    - `id` (string) — optional
      Unique identifier for the asset.
    - `model` (string) — optional
      Model name or number.
    - `name` (string) — optional
      Human-readable asset name.
    - `owner` (string) — optional
      The owner of the asset.
    - `serial_number` (string) — optional
      Serial number of the asset.
    - `vendor` (string) — optional
      Vendor or manufacturer.
  - `cloud` (object) — optional
    Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
    - `account` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `availability_zone` (string) — optional
    - `instance` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `machine` (object) — optional
      - `type` (string) — optional
    - `project` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
    - `provider` (string) — optional
    - `region` (string) — optional
    - `service` (object) — optional
      - `name` (string) — optional
  - `entity` (object) — optional
    - `attributes` (object) — optional
      Boolean flags describing characteristics of the entity.
      - `asset` (boolean) — optional
        Whether the entity is classified as an asset.
      - `known_redirects` (string[]) — optional
        Known redirect URIs or URLs (e.g. OAuth application callbacks).
      - `managed` (boolean) — optional
        Whether the entity is managed (for example, via a directory service).
      - `mfa_enabled` (boolean) — optional
        Whether multi-factor authentication is enabled for the entity.
      - `oauth_consent_restriction` (string) — optional
        OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
      - `permissions` (string[]) — optional
        Action-level permissions granted to this entity (not roles or groups).
      - `storage_class` (string) — optional
        Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
      - `watchlists` (string[]) — optional
        Watchlist identifiers the entity belongs to (v2).
    - `behaviors` (object) — optional
      Behavioral signals observed for the entity.
      - `anomaly_job_ids` (string[]) — optional
        Machine learning anomaly job identifiers (v2).
      - `rule_names` (string[]) — optional
        Detection rule names that flagged this entity (v2).
    - `created_by` (string) — optional
      Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
    - `EngineMetadata` (object) — optional
      - `Type` (string) — optional
        The engine type that produced this entity record.
    - `id` (string) — optional
      Unique identifier for this entity.
    - `lifecycle` (object) — optional
      Timestamps tracking the entity lifecycle.
      - `first_seen` (string · format: date-time · max length: 64) — optional
        When the entity was first observed.
      - `last_activity` (string · format: date-time · max length: 64) — optional
        When the entity last generated activity.
      - `last_seen` (string · format: date-time · max length: 64) — optional
        When the entity was last observed.
    - `name` (string) — optional
      Human-readable name of the entity.
    - `relationships` (object) — optional
      Connections between this entity and other entities.
      - `accesses_frequently` (object) — optional
        Entities this entity accesses frequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `accesses_infrequently` (object) — optional
        Entities this entity accesses infrequently.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `administers` (object) — optional
        Entities this entity administers (for example, a user who is an admin of a service).
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `communicates_with` (object) — optional
        Entities this entity communicates with.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `depends_on` (object) — optional
        Entities this entity depends on.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns` (object) — optional
        Entities owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `owns_inferred` (object) — optional
        Entities inferred to be owned by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
      - `resolution` (object) — optional
        Resolution metadata linking this entity to another.
        - `resolved_to` (string) — optional
          entity.id of the entity this one resolves to
        - `risk` (object) — optional
          Aggregated risk score for the resolution group.
          - `calculated_level` (enum) — optional
            Lexical description of the resolution group's aggregated risk.
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
            The raw numeric value of the resolution group's aggregated risk score.
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
            The normalized numeric value of the resolution group's aggregated risk score.
      - `supervises` (object) — optional
        Entities supervised by this entity.
        - `ids` (string[]) — optional
          Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
        - `raw_identifiers` (object) — optional
          - `entity.id` (string[]) — optional
          - `host.id` (string[]) — optional
          - `host.name` (string[]) — optional
          - `service.name` (string[]) — optional
          - `user.email` (string[]) — optional
          - `user.id` (string[]) — optional
          - `user.name` (string[]) — optional
    - `risk` (object) — optional
      Risk scoring information for the entity.
      - `calculated_level` (enum) — optional
        Lexical description of the entity's risk.
        Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
      - `calculated_score` (number) — optional
        The raw numeric value of the given entity's risk score.
      - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
    - `schema_version` (string) — optional
      Schema version of the entity record.
    - `source` (string[]) — optional
      Sources that produced this entity record.
    - `sub_type` (string) — optional
      Optional sub-type classification for the entity.
    - `type` (string) — optional
      The entity type.
    - `url` (string) — optional
      URL associated with the entity.
  - `event` (object) — optional
    - `ingested` (string · format: date-time · max length: 64) — optional
  - `labels` (map string to object) — optional
  - `orchestrator` (object) — optional
    Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
    - `api_version` (string) — optional
    - `cluster` (object) — optional
      - `id` (string) — optional
      - `name` (string) — optional
      - `url` (string) — optional
      - `version` (string) — optional
    - `namespace` (string) — optional
    - `organization` (string) — optional
    - `resource` (object) — optional
      - `annotation` (string) — optional
      - `id` (string) — optional
      - `ip` (string) — optional
      - `label` (string) — optional
      - `name` (string) — optional
      - `parent` (object) — optional
        - `type` (string) — optional
      - `type` (string) — optional
    - `type` (string) — optional
  - `tags` (string[]) — optional

## Responses

#### `200`

Indicates the entity was successfully updated.

`application/json`

#### `400`

Bad request.

`application/json`

#### `404`

Entity not found.

`application/json`

## Code examples

#### Console

```console
PUT kbn://api/security/entity_store/entities/user?force=true
{
  "entity": {
    "id": "user:jane.doe@example.com",
    "name": "jane.doe",
    "type": "user",
    "attributes": { "managed": true, "mfa_enabled": true }
  },
  "user": { "name": "jane.doe" }
}
```

#### curl

```curl
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entity":{"id":"user:jane.doe@example.com","name":"jane.doe","type":"user","attributes":{"managed":true,"mfa_enabled":true}},"user":{"name":"jane.doe"}}' \
  "${KIBANA_URL}/api/security/entity_store/entities/user?force=true"
```

## Response examples

#### Entity updated

`application/json`

The entity record was successfully updated.

```json
{
  "ok": true
}
```

#### Protected fields without force

`application/json`

The request attempts to update protected fields without the force query parameter.

```json
{
  "error": "Bad Request",
  "message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
  "statusCode": 400
}
```

#### Entity not found

`application/json`

No entity with the specified identifier exists.

```json
{
  "error": "Not Found",
  "message": "Entity ID \u0027user:jane.doe@example.com\u0027 not found",
  "statusCode": 404
}
```