GET /api/security/entity_store/status
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/security/entity_store/status

Refer to Spaces for more information.

Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.

[Required authorization] Route required privileges: securitySolution.

Query parameters

  • include_components string | boolean

    If true, returns a detailed status of each engine including all its components.

    Values are true or false. Default value is false.

Responses

  • 200 application/json

    Indicates a successful response.

GET /api/security/entity_store/status 
curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/status?include_components=false"

GET kbn://api/security/entity_store/status?include_components=false
Response examples (200)
The Entity Store has not been installed. 
{
  "engines": [],
  "status": "not_installed"
}
The Entity Store is running with two started engines using default settings. 
{
  "engines": [
    {
      "delay": "1m",
      "docsPerSecond": -1,
      "enrichPolicyExecutionInterval": null,
      "fieldHistoryLength": 10,
      "filter": "",
      "frequency": "30s",
      "indexPattern": "",
      "lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
      "lookbackPeriod": "3h",
      "maxPageSearchSize": 10000,
      "status": "started",
      "timeout": "25s",
      "timestampField": "@timestamp",
      "type": "host"
    },
    {
      "delay": "1m",
      "docsPerSecond": -1,
      "enrichPolicyExecutionInterval": null,
      "fieldHistoryLength": 10,
      "filter": "",
      "frequency": "30s",
      "indexPattern": "",
      "lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
      "lookbackPeriod": "3h",
      "maxPageSearchSize": 10000,
      "status": "started",
      "timeout": "25s",
      "timestampField": "@timestamp",
      "type": "user"
    }
  ],
  "status": "running"
}