---
title: "List all monitored users"
method: GET
path: "/api/entity_analytics/monitoring/users/list"
tags: ["Security Entity Analytics API"]
---

# List all monitored users

`GET /api/entity_analytics/monitoring/users/list`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/list</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

## Query parameters

- `kql` string

## Response `200`

List of monitored users

- SecurityEntityAnalyticsAPIMonitoredUserDoc[]
  - `entity_analytics_monitoring` object
    - `labels` SecurityEntityAnalyticsAPIMonitoringLabel[]
      - `field` string, required
      - `source` string, required
      - `value` string, required
  - `id` string
  - `labels` object
    - `source_ids` string[]
    - `source_integrations` string[]
    - `sources` string[]
  - `user` object
    - `is_privileged` boolean — Indicates if the user is privileged.
    - `name` string
    - `entity` object
      - `attributes` object
        - `Privileged` boolean — Indicates if the user is privileged.
  - `@timestamp` string, date-time
  - `event` object
    - `@timestamp` string, date-time
    - `ingested` string, date-time

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)