Disable an entity resolution rule Generally available; added in 9.5.0

PUT /api/security/entity_store/resolution/rules/{id}/disable
Api key auth Basic auth

Spaces method and path for this operation:

put /s/{space_id}/api/security/entity_store/resolution/rules/{id}/disable

Refer to Spaces for more information.

Disable a managed entity resolution rule in this space.

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Path parameters

  • id string Required

    The stable identifier of the entity resolution rule.

    Maximum length is 100.

Responses

  • 200 application/json

    Updated entity resolution rule.

  • 404 application/json

    Unknown entity resolution rule.

PUT /api/security/entity_store/resolution/rules/{id}/disable 
curl \
 --request PUT 'https://localhost:5601/api/security/entity_store/resolution/rules/{id}/disable' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: true"
Response examples (200)
The related user alias resolution rule was disabled in the current space. 
{
  "enabled": false,
  "id": "related_user_alias_resolution",
  "kind": "related_user_alias_resolution",
  "managed": true
}
Response examples (404)
The requested entity resolution rule does not exist. 
{
  "error": "Not Found",
  "message": "Saved object [entity-resolution-rule/unknown] not found",
  "statusCode": 404
}