# Elastic Stack (ELK Stack) Security Entity Analytics API

**Canonical:** https://apis.io/apis/elk-stack/elk-stack-security-entity-analytics-api-api/  
**Provider:** Elastic Stack (ELK Stack) — https://apis.io/providers/elk-stack/  
**Base URL:** https://{elasticsearch_endpoint}  
**Documentation:** https://www.elastic.co/docs/api/doc/elasticsearch/

Elastic Stack (ELK Stack) Security Entity Analytics API is one of 132 APIs that [Elastic Stack (ELK Stack)](https://apis.io/providers/elk-stack/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Entity Analytics API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.

## Operations (29)

| Method | Path | Summary |
|---|---|---|
| DELETE | `/api/asset_criticality` | Delete an asset criticality record |
| GET | `/api/asset_criticality` | Get an asset criticality record |
| POST | `/api/asset_criticality` | Upsert an asset criticality record |
| POST | `/api/asset_criticality/bulk` | Bulk upsert asset criticality records |
| GET | `/api/asset_criticality/list` | List asset criticality records |
| DELETE | `/api/entity_analytics/monitoring/engine/delete` | Delete the Privilege Monitoring Engine |
| POST | `/api/entity_analytics/monitoring/engine/disable` | Disable the Privilege Monitoring Engine |
| POST | `/api/entity_analytics/monitoring/engine/init` | Initialize the Privilege Monitoring Engine |
| POST | `/api/entity_analytics/monitoring/engine/schedule_now` | Schedule the Privilege Monitoring Engine |
| GET | `/api/entity_analytics/monitoring/privileges/health` | Health check on Privilege Monitoring |
| GET | `/api/entity_analytics/monitoring/privileges/privileges` | Run a privileges check on Privilege Monitoring |
| POST | `/api/entity_analytics/monitoring/users` | Create a new monitored user |
| POST | `/api/entity_analytics/monitoring/users/_csv` | Upsert multiple monitored users via CSV upload |
| DELETE | `/api/entity_analytics/monitoring/users/{id}` | Delete a monitored user |
| PUT | `/api/entity_analytics/monitoring/users/{id}` | Update a monitored user |
| GET | `/api/entity_analytics/monitoring/users/list` | List all monitored users |
| POST | `/api/entity_analytics/privileged_user_monitoring/pad/install` | Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience |
| GET | `/api/entity_analytics/privileged_user_monitoring/pad/status` | Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience |
| POST | `/api/entity_analytics/watchlists` | Create a new watchlist |
| GET | `/api/entity_analytics/watchlists/{id}` | Get a watchlist by ID |
| PUT | `/api/entity_analytics/watchlists/{id}` | Update an existing watchlist |
| POST | `/api/entity_analytics/watchlists/{watchlist_id}/csv_upload` | Upload a CSV file to add entities to a watchlist |
| POST | `/api/entity_analytics/watchlists/{watchlist_id}/entities/assign` | Manually assign entities to a watchlist |
| POST | `/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign` | Manually unassign entities from a watchlist |
| GET | `/api/entity_analytics/watchlists/list` | List all watchlists |
| DELETE | `/api/risk_score/engine/dangerously_delete_data` | Cleanup the Risk Engine |
| PATCH | `/api/risk_score/engine/saved_object/configure` | Configure the Risk Engine Saved Object |
| POST | `/api/risk_score/engine/schedule_now` | Run the risk scoring engine |
| GET | `/api/risk_score/history` | Get risk score history for an entity |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-entity-analytics-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/docs/reference/elasticsearch
- **APIReference** — https://www.elastic.co/docs/api/doc/elasticsearch/
- **SourceCode** — https://github.com/elastic/elasticsearch-specification
- **Documentation** — https://www.elastic.co/docs/reference/kibana
- **APIReference** — https://www.elastic.co/docs/api/doc/kibana/
- **SourceCode** — https://github.com/elastic/kibana
- **ToolCrosswalk** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

## Other Elastic Stack (ELK Stack) APIs (12)

- [Elastic Cloud API](https://apis.io/apis/elk-stack/elastic-cloud-api/)
- [Elastic Stack (ELK Stack) Accounts API](https://apis.io/apis/elk-stack/elk-stack-accounts-api/)
- [Elastic Stack (ELK Stack) Actions API](https://apis.io/apis/elk-stack/elk-stack-actions-api/)
- [Elastic Stack (ELK Stack) agent builder API](https://apis.io/apis/elk-stack/elk-stack-agent-builder-api/)
- [Elastic Stack (ELK Stack) Alerting API](https://apis.io/apis/elk-stack/elk-stack-alerting-api/)
- [Elastic Stack (ELK Stack) Alerting V2 API](https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/)
- [Elastic Stack (ELK Stack) Analytics API](https://apis.io/apis/elk-stack/elk-stack-analytics-api/)
- [Elastic Stack (ELK Stack) APM agent configuration API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-configuration-api/)
- [Elastic Stack (ELK Stack) APM agent keys API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-keys-api/)
- [Elastic Stack (ELK Stack) APM annotations API](https://apis.io/apis/elk-stack/elk-stack-apm-annotations-api/)
- [Elastic Stack (ELK Stack) APM server schema API](https://apis.io/apis/elk-stack/elk-stack-apm-server-schema-api/)
- [Elastic Stack (ELK Stack) APM sourcemaps API](https://apis.io/apis/elk-stack/elk-stack-apm-sourcemaps-api/)

## Tags

Security Entity Analytics API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/elk-stack/elk-stack-security-entity-analytics-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/elk-stack/.