PUT /api/security/entity_store/entities/{entityType}
Api key auth Basic auth

Spaces method and path for this operation:

put /s/{space_id}/api/security/entity_store/entities/{entityType}

Refer to Spaces for more information.

Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the force query parameter to true to update protected fields.

[Required authorization] Route required privileges: securitySolution.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Path parameters

  • entityType string Required

    The entity type to update.

    Values are user, host, service, or generic.

Query parameters

  • force string | boolean

    When true, allows updating protected fields.

    Values are true or false. Default value is false.

application/json
Body object
Any of:
object-1 object object-2 object object-3 object object-4 object

Responses

  • 200 application/json

    Indicates the entity was successfully updated.

  • 400 application/json

    Bad request.

  • 404 application/json

    Entity not found.

PUT /api/security/entity_store/entities/{entityType} 
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entity":{"id":"user:jane.doe@example.com","name":"jane.doe","type":"user","attributes":{"managed":true,"mfa_enabled":true}},"user":{"name":"jane.doe"}}' \
  "${KIBANA_URL}/api/security/entity_store/entities/user?force=true"

PUT kbn://api/security/entity_store/entities/user?force=true
{
  "entity": {
    "id": "user:jane.doe@example.com",
    "name": "jane.doe",
    "type": "user",
    "attributes": { "managed": true, "mfa_enabled": true }
  },
  "user": { "name": "jane.doe" }
}
Request example
Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter. 
{
  "entity": {
    "attributes": {
      "managed": true,
      "mfa_enabled": true
    },
    "id": "user:jane.doe@example.com",
    "lifecycle": {
      "last_activity": "2026-04-10T14:30:00.000Z"
    },
    "name": "jane.doe",
    "type": "user"
  },
  "user": {
    "email": [
      "jane.doe@example.com"
    ],
    "name": "jane.doe",
    "roles": [
      "admin",
      "analyst"
    ]
  }
}
Response examples (200)
The entity record was successfully updated. 
{
  "ok": true
}
Response examples (400)
The request attempts to update protected fields without the force query parameter. 
{
  "error": "Bad Request",
  "message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
  "statusCode": 400
}
Response examples (404)
No entity with the specified identifier exists. 
{
  "error": "Not Found",
  "message": "Entity ID 'user:jane.doe@example.com' not found",
  "statusCode": 404
}