---
title: "List all monitored users"
method: GET
path: "/api/entity_analytics/monitoring/users/list"
tags: ["Security Entity Analytics API"]
deprecated: true
---

# List all monitored users

`GET /api/entity_analytics/monitoring/users/list`

> **Deprecated.**

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/list</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

**Deprecated in 9.4.0.** Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

## Query parameters

- `kql` string

## Response `200`

List of monitored users

- SecurityEntityAnalyticsAPIMonitoredUserDoc[]
  - `entity_analytics_monitoring` object
    - `labels` SecurityEntityAnalyticsAPIMonitoringLabel[]
      - `field` string, required
      - `source` string, required
      - `value` string, required
  - `id` string
  - `labels` object
    - `source_ids` string[]
    - `source_integrations` string[]
    - `sources` string[]
  - `user` object
    - `is_privileged` boolean — Indicates if the user is privileged.
    - `name` string
    - `entity` object
      - `attributes` object
        - `Privileged` boolean — Indicates if the user is privileged.
  - `@timestamp` string, date-time
  - `event` object
    - `@timestamp` string, date-time
    - `ingested` string, date-time

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/d3fa2d005f9b/schema)