Kibana Security entity store API
The Security entity store API from Kibana — 13 operation(s) for security entity store.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Security entity store API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Security entity store
paths:
/api/security/entity_store:
put:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/security/entity_store</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update the Entity Store log extraction configuration.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
updateLogExtractionExample:
description: Update the log extraction configuration with a new lookback period and frequency.
summary: Update log extraction settings
value:
logExtraction:
fieldHistoryLength: 15
frequency: 10m
lookbackPeriod: 6h
schema:
additionalProperties: false
type: object
properties:
logExtraction:
additionalProperties: false
type: object
properties:
additionalIndexPatterns:
items:
type: string
type: array
delay:
pattern: '[smdh]$'
type: string
docsLimit:
maximum: 9007199254740991
minimum: 1
type: integer
fieldHistoryLength:
maximum: 9007199254740991
minimum: -9007199254740991
type: integer
frequency:
pattern: '[smdh]$'
type: string
lookbackPeriod:
pattern: '[smdh]$'
type: string
maxLogsPerPage:
maximum: 9007199254740991
minimum: 1
type: integer
required:
- logExtraction
responses:
'200':
content:
application/json:
examples:
updateSuccessExample:
description: The Entity Store configuration was successfully updated.
summary: Entity Store updated
value:
ok: true
description: Indicates a successful response.
'400':
content:
application/json:
examples:
invalidDurationExample:
description: A log extraction parameter has an invalid duration format.
summary: Invalid duration parameter
value:
error: Bad Request
message: '[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)'
statusCode: 400
description: Bad request.
'404':
content:
application/json:
examples:
notFoundExample:
description: The Entity Store has not been installed yet.
summary: Entity Store not installed
value:
error: Not Found
message: Entity store is not installed
statusCode: 404
description: Entity Store not found.
summary: Update the Entity Store
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"logExtraction\":{\"lookbackPeriod\":\"6h\",\"frequency\":\"10m\",\"fieldHistoryLength\":15}}' \\\n \"${KIBANA_URL}/api/security/entity_store\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store\n{\n \"logExtraction\": {\n \"lookbackPeriod\": \"6h\",\n \"frequency\": \"10m\",\n \"fieldHistoryLength\": 15\n }\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/security/entity_store/entities</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
operationId: get-security-entity-store-entities
parameters:
- description: A Kibana Query Language (KQL) filter for the search-after mode.
in: query
name: filter
required: false
schema:
type: string
- description: Number of entities to return in search-after mode.
in: query
name: size
required: false
schema:
maximum: 9007199254740991
minimum: 1
type: integer
- description: JSON-encoded search_after value for cursor-based pagination.
in: query
name: searchAfter
required: false
schema:
type: string
- description: Fields to include in the response source.
in: query
name: source
required: false
schema:
items:
type: string
type: array
- description: Fields to include in the response.
in: query
name: fields
required: false
schema:
items:
type: string
type: array
- description: Field to sort results by in page mode.
in: query
name: sort_field
required: false
schema:
type: string
- description: Sort order in page mode.
in: query
name: sort_order
required: false
schema:
enum:
- asc
- desc
type: string
- description: Page number to return (1-indexed) in page mode.
in: query
name: page
required: false
schema:
maximum: 9007199254740991
minimum: 1
type: integer
- description: Number of entities per page in page mode.
in: query
name: per_page
required: false
schema:
maximum: 10000
minimum: 1
type: integer
- description: An Elasticsearch query string to filter entities in page mode.
in: query
name: filterQuery
required: false
schema:
type: string
- description: Entity types to include in the results.
in: query
name: entity_types
required: false
schema:
items:
enum:
- user
- host
- service
- generic
type: string
type: array
responses:
'200':
content:
application/json:
examples:
emptyResultExample:
description: No entities matched the query.
summary: Empty result
value:
page: 1
per_page: 10
records: []
total: 0
pageModeExample:
description: A paginated list of host entities sorted by timestamp in descending order, including query inspection data.
summary: Page mode response with host entities
value:
inspect:
dsl:
- '{"index":["entities-latest-default"],"body":{"terms":{"entity.EngineMetadata.Type":["host"]}}}'
response:
- '{"took":1,"timed_out":false,"hits":{"total":{"value":1,"relation":"eq"}}}'
page: 1
per_page: 10
records:
- '@timestamp': '2026-04-10T08:30:00.000Z'
asset:
criticality: high_impact
environment: production
entity:
attributes:
asset: true
managed: true
id: host:web-server-prod-01
lifecycle:
first_seen: '2026-01-15T10:00:00.000Z'
last_activity: '2026-04-10T08:30:00.000Z'
name: web-server-prod-01
risk:
calculated_level: Moderate
calculated_score: 47.5
calculated_score_norm: 47.5
source:
- logs
type: host
host:
hostname:
- web-server-prod-01.example.com
ip:
- 10.0.1.42
name: web-server-prod-01
os:
name: Ubuntu
type: linux
total: 1
searchAfterModeExample:
description: A cursor-based response with entities and a search_after token for the next page.
summary: Search-after mode response
value:
entities:
- '@timestamp': '2026-04-10T08:30:00.000Z'
entity:
id: user:jane.doe@example.com
name: jane.doe
type: user
user:
email:
- jane.doe@example.com
name: jane.doe
nextSearchAfter:
- 1712736600000
- 1
description: Indicates a successful response.
'400':
content:
application/json:
examples:
invalidFilterExample:
description: The provided Kibana Query Language filter could not be parsed.
summary: Invalid filter
value:
error: Bad Request
message: 'Invalid filter: Expected "(", "{", value, whitespace but ":" found.
invalid :: query
---------^'
statusCode: 400
mixedModesExample:
description: Cannot combine page-based pagination with cursor-based pagination in the same request.
summary: Mixed pagination modes
value:
error: Bad Request
message: '[request query]: Cannot combine page/per_page with searchAfter'
statusCode: 400
description: Bad request.
summary: List entities
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc\"\n"
- lang: Console
source: 'GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc
'
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities/:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/security/entity_store/entities/</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
operationId: delete-security-entity-store-entities
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
deleteEntityExample:
description: Delete a single entity from the Entity Store using its entity identifier.
summary: Delete an entity by identifier
value:
entityId: host:web-server-prod-01
schema:
additionalProperties: false
type: object
properties:
entityId:
description: The identifier of the entity to delete.
type: string
required:
- entityId
responses:
'200':
content:
application/json:
examples:
deleteSuccessExample:
description: The entity was found and successfully removed from the latest index.
summary: Entity deleted
value:
deleted: true
description: Indicates the entity was successfully deleted.
'404':
content:
application/json:
examples:
notFoundExample:
description: No entity with the specified identifier exists in the Entity Store.
summary: Entity not found
value:
error: Not Found
message: Entity ID 'host:web-server-prod-01' not found
statusCode: 404
description: Entity not found.
summary: Delete an entity
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X DELETE -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityId\":\"host:web-server-prod-01\"}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/\"\n"
- lang: Console
source: "DELETE kbn://api/security/entity_store/entities/\n{\n \"entityId\": \"host:web-server-prod-01\"\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities/{entityType}:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/security/entity_store/entities/{entityType}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new entity record in the Entity Store for the specified entity type.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
operationId: post-security-entity-store-entities-entitytype
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The entity type to create.
in: path
name: entityType
required: true
schema:
enum:
- user
- host
- service
- generic
type: string
requestBody:
content:
application/json:
examples:
createHostEntityExample:
description: Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.
summary: Create a host entity
value:
asset:
business_unit: Engineering
criticality: high_impact
environment: production
entity:
attributes:
asset: true
managed: true
id: host:web-server-prod-01
name: web-server-prod-01
source:
- manual
type: host
host:
hostname:
- web-server-prod-01.example.com
ip:
- 10.0.1.42
name: web-server-prod-01
schema:
anyOf:
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
# --- truncated at 32 KB (382 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-entity-store-api-openapi.yml