How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Kibana

Kibana Security Entity Analytics API API

Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.

Documentation Provider Profile APIs.io OpenAPI GitHub

Kibana Security Entity Analytics API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Entity Analytics API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

This API exposes 42 operations across 35 paths, and defines 59 schemas. It is described by OpenAPI 3.2.0, at version 1.0.

Requests are made against a single base URL, https://{kibana_url}.

42 operations 35 paths 59 schemas 7 DELETE12 GET1 PATCH18 POST4 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.0
Base URL
https://localhost:5601/api
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Kibana Security Entity Analytics API API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 42

Across 35 paths, the API surfaces 42 operations — 7 DELETE, 12 GET, 1 PATCH, 18 POST, 4 PUT. Each is listed below with its method, path, parameters, and response codes.

Security Entity Analytics API 42

Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.

DELETE
/api/asset_criticality
Delete an asset criticality record
DeleteAssetCriticalityRecord 3 params → 200400
GET
/api/asset_criticality
Get an asset criticality record
GetAssetCriticalityRecord 2 params → 200400404
POST
/api/asset_criticality
Upsert an asset criticality record
CreateAssetCriticalityRecord body → 200400
POST
/api/asset_criticality/bulk
Bulk upsert asset criticality records
BulkUpsertAssetCriticalityRecords body → 200413
GET
/api/asset_criticality/list
List asset criticality records
FindAssetCriticalityRecords 5 params → 200
DELETE
/api/entity_analytics/monitoring/engine/delete
Delete the Privilege Monitoring Engine
DeleteMonitoringEngine 1 param → 200
POST
/api/entity_analytics/monitoring/engine/disable
Disable the Privilege Monitoring Engine
DisableMonitoringEngine → 200
POST
/api/entity_analytics/monitoring/engine/init
Initialize the Privilege Monitoring Engine
InitMonitoringEngine → 200500
POST
/api/entity_analytics/monitoring/engine/schedule_now
Schedule the Privilege Monitoring Engine
ScheduleMonitoringEngine → 200409
GET
/api/entity_analytics/monitoring/privileges/health
Health check on Privilege Monitoring
PrivMonHealth → 200
GET
/api/entity_analytics/monitoring/privileges/privileges
Run a privileges check on Privilege Monitoring
PrivMonPrivileges → 200
POST
/api/entity_analytics/monitoring/users
Create a new monitored user
CreatePrivMonUser body → 200
POST
/api/entity_analytics/monitoring/users/_csv
Upsert multiple monitored users via CSV upload
PrivmonBulkUploadUsersCSV body → 200413
DELETE
/api/entity_analytics/monitoring/users/{id}
Delete a monitored user
DeletePrivMonUser 1 param → 200
PUT
/api/entity_analytics/monitoring/users/{id}
Update a monitored user
UpdatePrivMonUser 1 param body → 200
GET
/api/entity_analytics/monitoring/users/list
List all monitored users
ListPrivMonUsers 1 param → 200
POST
/api/entity_analytics/privileged_user_monitoring/pad/install
Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
InstallPrivilegedAccessDetectionPackage → 200
GET
/api/entity_analytics/privileged_user_monitoring/pad/status
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
GetPrivilegedAccessDetectionPackageStatus → 200
POST
/api/entity_analytics/watchlists
Create a new watchlist
CreateWatchlist body → 200
GET
/api/entity_analytics/watchlists/{id}
Get a watchlist by ID
GetWatchlist 1 param → 200
PUT
/api/entity_analytics/watchlists/{id}
Update an existing watchlist
UpdateWatchlist 1 param body → 200
POST
/api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Upload a CSV file to add entities to a watchlist
UploadWatchlistCsv 1 param body → 200413
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/assign
Manually assign entities to a watchlist
AssignWatchlistEntities 1 param body → 200
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign
Manually unassign entities from a watchlist
UnassignWatchlistEntities 1 param body → 200
GET
/api/entity_analytics/watchlists/list
List all watchlists
ListWatchlists → 200
POST
/api/entity_store/enable
Initialize the Entity Store
InitEntityStore body → 200400
DELETE
/api/entity_store/engines
Delete Entity Engines
DeleteEntityEngines 2 params → 200
GET
/api/entity_store/engines
List the Entity Engines
ListEntityEngines → 200
DELETE
/api/entity_store/engines/{entityType}
Delete the Entity Engine
DeleteEntityEngine 3 params → 200
GET
/api/entity_store/engines/{entityType}
Get an Entity Engine
GetEntityEngine 1 param → 200
POST
/api/entity_store/engines/{entityType}/init
Initialize an Entity Engine
InitEntityEngine 1 param body → 200400
POST
/api/entity_store/engines/{entityType}/start
Start an Entity Engine
StartEntityEngine 1 param → 200
POST
/api/entity_store/engines/{entityType}/stop
Stop an Entity Engine
StopEntityEngine 1 param → 200
POST
/api/entity_store/engines/apply_dataview_indices
Apply DataView indices to all installed engines
ApplyEntityEngineDataviewIndices → 200207500
DELETE
/api/entity_store/entities/{entityType}
Delete an entity in Entity Store
DeleteSingleEntity 1 param body → 200404503
PUT
/api/entity_store/entities/{entityType}
Upsert an entity in Entity Store
UpsertEntity 2 params body → 200403409503
PUT
/api/entity_store/entities/bulk
Upsert many entities in Entity Store
UpsertEntitiesBulk 1 param body → 200403503
GET
/api/entity_store/entities/list
List Entity Store Entities
ListEntities 6 params → 200
GET
/api/entity_store/status
Get the status of the Entity Store
GetEntityStoreStatus 1 param → 200
DELETE
/api/risk_score/engine/dangerously_delete_data
Cleanup the Risk Engine
CleanUpRiskEngine → 200400default
PATCH
/api/risk_score/engine/saved_object/configure
Configure the Risk Engine Saved Object
ConfigureRiskEngineSavedObject body → 200400default
POST
/api/risk_score/engine/schedule_now
Run the risk scoring engine
ScheduleRiskEngineNow body → 200400default

Schemas 59

The contract defines 59 schemas that model the data the API accepts and returns. The most detailed are Security_Entity_Analytics_API_EntityRiskScoreRecord (18 properties), Security_Entity_Analytics_API_TransformStatsMetadata (17 properties), Security_Entity_Analytics_API_EngineDescriptor (12 properties), Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties (11 properties). Each schema is shown below with its type and property counts.

Security_Entity_Analytics_API_RiskScoreInput
object
A generic representation of a document contributing to a Risk Score.
8 properties 4 required
Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus
string
The status of the Privilege Monitoring Engine
Security_Entity_Analytics_API_PrivmonUserCsvUploadStats
object
4 properties 4 required
Security_Entity_Analytics_API_ServiceEntity
object
An entity record representing a service, stored in the Entity Store latest index.
5 properties 1 required
Security_Entity_Analytics_API_EntityType
string
The type of entity.
Security_Entity_Analytics_API_UserName
object
2 properties
Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties
object
11 properties
Security_Entity_Analytics_API_GenericEntity
object
A generic entity record. Maps only the entity and asset namespaces. Add additional field mappings here as needed.
3 properties 1 required
Security_Entity_Analytics_API_MonitoringEntitySourceProperties
Security_Entity_Analytics_API_IdField
string
Security_Entity_Analytics_API_EngineStatus
string
The current operational status of an entity engine.
Security_Entity_Analytics_API_Asset
object
Asset metadata associated with the entity.
9 properties
Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem
object
3 properties 2 required
Security_Entity_Analytics_API_MonitoredUserUpdateDoc
object
4 properties
Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse
object
2 properties 2 required
Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem
object
3 properties 2 required
Security_Entity_Analytics_API_CreateAssetCriticalityRecord
Security_Entity_Analytics_API_Integrations
object
2 properties
Security_Entity_Analytics_API_EngineMetadata
object
Internal metadata attached to an entity by the engine that produced it.
1 property 1 required
Security_Entity_Analytics_API_EngineDescriptor
object
Describes a single entity engine, including its configuration and current status.
12 properties 4 required
Security_Entity_Analytics_API_EntityAnalyticsPrivileges
object
4 properties 2 required
Security_Entity_Analytics_API_UserEntity
object
An entity record representing a user, stored in the Entity Store latest index.
5 properties 1 required
Security_Entity_Analytics_API_Filter
object
1 property
Security_Entity_Analytics_API_InspectQuery
object
Debug information about the Elasticsearch query executed.
2 properties 2 required
Security_Entity_Analytics_API_EntityField
object
Core entity fields shared across all entity types. The entity namespace is a root-level field in the Entity Store latest index.
11 properties 1 required
Security_Entity_Analytics_API_Interval
string
Interval in which enrich policy runs. For example, "1h" means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem
object
2 properties 2 required
Security_Entity_Analytics_API_RiskEngineScheduleNowResponse
object
1 property
Security_Entity_Analytics_API_MonitoredUserDoc
Security_Entity_Analytics_API_WatchlistObject
object
9 properties 3 required
Security_Entity_Analytics_API_AssetCriticalityRecord
Security_Entity_Analytics_API_MonitoringLabel
object
3 properties 3 required
Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse
object
2 properties 2 required
Security_Entity_Analytics_API_Matcher
object
2 properties 2 required
Security_Entity_Analytics_API_EntityContainer
object
A wrapper that pairs an entity type with the entity record to upsert.
2 properties 2 required
Security_Entity_Analytics_API_MonitoringEngineDescriptor
object
2 properties 1 required
Security_Entity_Analytics_API_DateRange
object
Defines the lookback period for filtering source data by timestamp.
2 properties 2 required
Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload
string
The criticality level of the asset for bulk upload. The value unassigned is used to indicate that the criticality level is not assigned and is only used for bu…
Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem
object
3 properties 3 required
Security_Entity_Analytics_API_IndexPattern
string
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
Security_Entity_Analytics_API_EntitiesContainer
object
A collection of entities to upsert in bulk.
1 property 1 required
Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts
object
5 properties 1 required
Security_Entity_Analytics_API_EntitySourceType
string
Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats
object
3 properties 3 required
Security_Entity_Analytics_API_EngineDataviewUpdateResult
object
The result of applying data view index changes to a single engine.
2 properties 1 required
Security_Entity_Analytics_API_MonitoringEntitySource
Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse
object
2 properties 2 required
Security_Entity_Analytics_API_HostEntity
object
An entity record representing a host, stored in the Entity Store latest index.
5 properties 1 required
Security_Entity_Analytics_API_EngineComponentResource
string
The type of Elasticsearch or Kibana resource backing an engine component.
Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem
object
3 properties 2 required
Security_Entity_Analytics_API_AssetCriticalityRecordIdParts
object
2 properties 2 required
Security_Entity_Analytics_API_EngineComponentStatus
object
Status of an individual Elasticsearch or Kibana resource backing an engine.
6 properties 3 required
Security_Entity_Analytics_API_Entity
An entity record from the Entity Store. The entity namespace is a root-level field in the latest index, unlike source logs where it is nested under host, user,…
Security_Entity_Analytics_API_StoreStatus
string
The overall operational status of the Entity Store.
Security_Entity_Analytics_API_TransformStatsMetadata
object
Statistics from the underlying Elasticsearch transform.
17 properties 15 required
Security_Entity_Analytics_API_AssetCriticalityLevel
string
The criticality level of the asset.
Security_Entity_Analytics_API_EntityRiskLevels
string
Security_Entity_Analytics_API_EntityRiskScoreRecord
object
18 properties 10 required
Security_Entity_Analytics_API_TaskManagerUnavailableResponse
object
Task manager is unavailable
2 properties 2 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kibana-security-entity-analytics-api-api-openapi.yml Raw ↑

Other APIs Kibana publishes across the network.

Kibana Actions API
AE Profile APIs.io
Kibana agent builder API
AE Profile APIs.io
Kibana alerting API
AE Profile APIs.io
Kibana APM agent configuration API
AE Profile APIs.io
Kibana APM agent keys API
AE Profile APIs.io
Kibana APM annotations API
AE Profile APIs.io
Kibana APM server schema API
AE Profile APIs.io
Kibana APM sourcemaps API
AE Profile APIs.io
Kibana cases API
AE Profile APIs.io
Kibana connectors API
AE Profile APIs.io
Kibana Data streams API
AE Profile APIs.io
Kibana data views API
AE Profile APIs.io
#Security Entity Analytics API
← Back to K APIs
API Details
ID
kibana:kibana-security-entity-analytics-api-api
Base URL
https://localhost:5601/api
Docs
https://www.elastic.co/guide/en/kibana/current/api.html
Provider
Kibana
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=kibana-security-entity-analytics-api-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/kibana-security-entity-analytics-api-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Kibana Security Entity Analytics API API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.