{
  "opencollection": "1.0.0",
  "info": {
    "name": "Kibana APIs Actions Security entity store API",
    "version": "1.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "Authorization",
      "value": "{{Authorization}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Security entity store",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Update the Entity Store",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/security/entity_store",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the Entity Store log extraction configuration.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "List entities",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/security/entity_store/entities",
            "params": [
              {
                "name": "filter",
                "value": "",
                "type": "query",
                "description": "A Kibana Query Language (KQL) filter for the search-after mode."
              },
              {
                "name": "size",
                "value": "",
                "type": "query",
                "description": "Number of entities to return in search-after mode."
              },
              {
                "name": "searchAfter",
                "value": "",
                "type": "query",
                "description": "JSON-encoded search_after value for cursor-based pagination."
              },
              {
                "name": "source",
                "value": "",
                "type": "query",
                "description": "Fields to include in the response source."
              },
              {
                "name": "fields",
                "value": "",
                "type": "query",
                "description": "Fields to include in the response."
              },
              {
                "name": "sort_field",
                "value": "",
                "type": "query",
                "description": "Field to sort results by in page mode."
              },
              {
                "name": "sort_order",
                "value": "",
                "type": "query",
                "description": "Sort order in page mode."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Page number to return (1-indexed) in page mode."
              },
              {
                "name": "per_page",
                "value": "",
                "type": "query",
                "description": "Number of entities per page in page mode."
              },
              {
                "name": "filterQuery",
                "value": "",
                "type": "query",
                "description": "An Elasticsearch query string to filter entities in page mode."
              },
              {
                "name": "entity_types",
                "value": "",
                "type": "query",
                "description": "Entity types to include in the results."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/entities</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be comb"
        },
        {
          "info": {
            "name": "Delete an entity",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{kibana_url}/api/security/entity_store/entities/",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb delete\">delete</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/entities/</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a single entity record from the Entity Store. The entity is immediately removed from the latest index.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Create an entity",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/security/entity_store/entities/:entityType",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "entityType",
                "value": "",
                "type": "path",
                "description": "The entity type to create."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/entities/{entityType}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new entity record in the Entity Store for the specified entity type.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Update an entity",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/security/entity_store/entities/:entityType",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "entityType",
                "value": "",
                "type": "path",
                "description": "The entity type to update."
              },
              {
                "name": "force",
                "value": "",
                "type": "query",
                "description": "When true, allows updating protected fields."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/entities/{entityType}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.<br/><br/>[Required autho"
        },
        {
          "info": {
            "name": "Bulk update entities",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/security/entity_store/entities/bulk",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "force",
                "value": "",
                "type": "query",
                "description": "When true, allows updating protected fields."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/entities/bulk</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate multiple entity records in the Entity Store in a single request.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Install the Entity Store",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/security/entity_store/install",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/install</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it "
        },
        {
          "info": {
            "name": "Get resolution group",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/security/entity_store/resolution/group",
            "params": [
              {
                "name": "entity_id",
                "value": "",
                "type": "query",
                "description": "The entity identifier to look up the resolution group for."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/resolution/group</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the resolution group for a given entity, returning all linked entities. Requires an enterprise license.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySo"
        },
        {
          "info": {
            "name": "Link entities",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/security/entity_store/resolution/link",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/resolution/link</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nLink one or more entities to a target entity, creating a resolution group. Requires an enterprise license.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySo"
        },
        {
          "info": {
            "name": "Unlink entities",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/security/entity_store/resolution/unlink",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/resolution/unlink</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRemove one or more entities from their resolution group. Requires an enterprise license.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-an"
        },
        {
          "info": {
            "name": "Start Entity Store engines",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/security/entity_store/start",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/start</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStart previously stopped entity engines, resuming data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Get Entity Store status",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/security/entity_store/status",
            "params": [
              {
                "name": "include_components",
                "value": "",
                "type": "query",
                "description": "If true, returns a detailed status of each engine including all its components."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the overall Entity Store status and per-engine statuses, optionally including component-level health details.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Stop Entity Store engines",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/security/entity_store/stop",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/stop</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStop running entity engines, pausing data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        },
        {
          "info": {
            "name": "Uninstall the Entity Store",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/security/entity_store/uninstall",
            "headers": [
              {
                "name": "kbn-xsrf",
                "value": ""
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/security/entity_store/uninstall</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUninstall the Entity Store, removing engines and associated resources for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution."
        }
      ]
    }
  ],
  "bundled": true
}