---
title: "Create a new monitored user"
method: POST
path: "/api/entity_analytics/monitoring/users"
tags: ["Security Entity Analytics API"]
---

# Create a new monitored user

`POST /api/entity_analytics/monitoring/users`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Creates a new privileged user to be monitored by the Privilege Monitoring Engine.

## Request body

- SecurityEntityAnalyticsAPIUserName
  - `entity_analytics_monitoring` object — Entity analytics monitoring configuration for the user
    - `labels` object[] — Array of labels associated with the user
      - `field` string — The field name for the label
      - `source` 'api' | 'csv' | 'index_sync' — The source where this label was created (api, csv, or index_sync)
      - `value` string — The value of the label
  - `user` object
    - `name` string — The name of the user.

## Response `200`

User created successfully

- SecurityEntityAnalyticsAPIMonitoredUserDoc
  - `entity_analytics_monitoring` object
    - `labels` SecurityEntityAnalyticsAPIMonitoringLabel[]
      - `field` string, required
      - `source` string, required
      - `value` string, required
  - `id` string
  - `labels` object
    - `source_ids` string[]
    - `source_integrations` string[]
    - `sources` string[]
  - `user` object
    - `is_privileged` boolean — Indicates if the user is privileged.
    - `name` string
    - `entity` object
      - `attributes` object
        - `Privileged` boolean — Indicates if the user is privileged.
  - `@timestamp` string, date-time
  - `event` object
    - `@timestamp` string, date-time
    - `ingested` string, date-time

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)