Security Entity Analytics API

Update an existing watchlist

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{id}</span></div>

Refer to Spaces for more information.

Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.

put/api/entity_analytics/watchlists/{id}

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/entity_analytics/watchlists/{id}
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

idstring required

The ID of the watchlist to update

Request body

descriptionstring

Description of the watchlist

managedboolean

Indicates if the watchlist is managed by the system

namestring required

Unique name of the watchlist

riskModifiernumber required

Risk score modifier associated with the watchlist

Response

Watchlist updated successfully

createdAtstring date-time

Timestamp indicating when the watchlist was created

descriptionstring

Description of the watchlist

entityCountnumber

Number of entities in the watchlist

entitySourceIdsstring[]

List of entity source IDs associated with the watchlist

hasManualEntitiesboolean

Indicates whether the watchlist contains manually assigned entities

idstring

The unique ID of the watchlist

managedboolean required

Indicates if the watchlist is managed by the system

namestring required

The name of the watchlist

riskModifiernumber required

Risk score modifier associated with the watchlist

updatedAtstring date-time

Timestamp indicating when the watchlist was last updated

Example response

{
  "createdAt": "2026-01-28T12:00:00.000Z",
  "description": "High risk vendor watchlist",
  "id": "watchlist-123",
  "managed": false,
  "name": "High Risk Vendors",
  "riskModifier": 1.5,
  "updatedAt": "2026-02-18T12:00:00.000Z"
}

Changes