---
title: "Update a conversation's access control"
method: PUT
path: "/api/agent_builder/conversations/{conversation_id}/access_control"
tags: ["agent builder"]
---

# Update a conversation's access control

`PUT /api/agent_builder/conversations/{conversation_id}/access_control`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/access_control</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Replace a conversation's access mode and member list. Only the conversation owner can call this endpoint; every other caller receives a not-found response. Each call replaces the entire access control — the most recent successful update wins. Members can read and continue the conversation, but still need access to the conversation's agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.

## Path parameters

- `conversation_id` string, required

## Headers

- `kbn-xsrf` string, required

## Request body

- object
  - `access_mode` 'private' | 'public', required — Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation's agent can read and continue it).
  - `entries` object[], required — Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected.
    - `id` string, required — Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access.
    - `role` 'member', required — Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation.
    - `type` 'user', required

## Response `200`

Indicates a successful response

## Other responses

- `400` — Bad Request — the request body failed validation.
- `404` — Not Found — no conversation with this ID is readable by the caller, or the caller is not its owner. Matches the existing `conversationNotFound` shape, so members cannot distinguish a conversation they may not re-share from one that does not exist.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/93e11b266872/schema)