---
title: "Update an agent's access control list"
method: PUT
path: "/api/agent_builder/agents/{id}/access_control"
tags: ["agent builder"]
---

# Update an agent's access control list

`PUT /api/agent_builder/agents/{id}/access_control`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}/access_control</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Replace the per-agent access-control entries. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.

## Path parameters

- `id` string, required

## Headers

- `kbn-xsrf` string, required

## Request body

- object
  - `entries` object[], required — Access-control entries to apply to the agent. Each entry has a `type` (currently only `user` is supported), a `name` (the principal username), and a `role`.
    - `name` string, required — Case-sensitive Kibana username of the principal to grant access to.
    - `role` 'user' | 'editor' | 'manager', required — Role granted to the principal. Roles are hierarchical: `user` allows viewing, listing, reading, and running the agent; `editor` adds updating the agent and its access control; `manager` adds deleting the agent and managing access control.
    - `type` 'user', required

## Response `200`

Indicates a successful response

## Other responses

- `400` — Bad Request — the request body failed validation, or the request targets the built-in Elastic default agent (which cannot have custom access control).
- `404` — Not Found — no agent with this ID is visible to the caller, or the caller lacks write access. Matches the existing `agentNotFound` shape so unprivileged callers cannot probe for hidden agents.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)