Update a monitored user

Base URL: https://{kibana_url}

PUT /api/entity_analytics/monitoring/users/{id}

Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Updates the details of an existing monitored privileged user by their document ID.

Path parameters

id string required: The document ID of the monitored user to update

Request body

entity_analytics_monitoring object
id string · max length: 256
labels object
user object

Response

User updated successfully

application/json

entity_analytics_monitoring object
id string · max length: 256
labels object
user object
@timestamp string · format: date-time
event object

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/entity_analytics/monitoring/users/ID
{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/entity_analytics/monitoring/users/${ID}" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "Security"
        }
      ]
    },
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  }'

Generated from the API spec

Response

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Path parameters

Request body { }

Response

Request body