Elastic Cloud API keys

Elastic Cloud API keys allow you to programmatically access the following resources:

• Elastic Cloud APIs
• Elastic Cloud Serverless APIs
• Optionally, Elasticsearch Elastic Cloud Serverless and Kibana Elastic Cloud Serverless APIs

Only Organization owners can create and manage API keys. An API key is not tied to the user who created it. When creating a key, you assign it specific roles to control its access to organizational resources, including hosted deployments and serverless projects. If a user leaves the organization, the API keys they have created will still function until they expire.

You can have multiple API keys for different purposes, and you can revoke them when you no longer need them. Each organization can have up to 500 active API keys.

Authorization: ApiKey $EC_API_KEY
		

curl -XPOST \
-H 'Content-Type: application/json' \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/users/auth/keys

{
  "description": "api-created-key",
  "expiration": "90d",
  "role_assignments": {
    "project": {
      "elasticsearch": [
        {
          "role_id": "elasticsearch-admin",
          "organization_id": "ORG_ID_PLACEHOLDER",
          "all": false,
          "project_ids": [
            "PROJECT_ID_PLACEHOLDER"
          ],
          "application_roles": [
            "admin"
          ]
        }
      ]
    }
  }
}
		

1. Log in to Elastic Cloud.
2. From the navigation menu, select Organization > API keys.
3. Find the key you want to revoke, and click the trash icon under Actions.

By default, API keys expire after three months. You can set the expiration to a different preset value or to a specific date, up to one year. If you need the key to work indefinitely, you can set its expiration to Never.

When an API key is nearing expiration, Elastic sends an email to the creator of the API key and each of the operational contacts. When you use an API key to authenticate, the API response header X-Elastic-Api-Key-Expiration indicates the key’s expiration date. You can log this value to detect API keys that are nearing expiration.

When an API key expires, it is automatically removed from the API keys tab.

Roles grant an API key specific privileges for your Elastic Cloud organization and resources.

You can grant a cloud API key the same types of roles that you assign to users: organization-level roles, cloud resource access roles, and connected cluster roles.

When you grant Organization owner access, or Cloud resource access for one or more Serverless projects, you can select your level of API access:

Using Elastic Cloud keys for project-level API access, rather than granting keys from within each Serverless project, allows you to create keys that can interact with multiple projects, and manage API access centrally from the Elastic Cloud console.

When granting Cloud resource access, you can apply a predefined role or custom role to granularly control access to the specified resources. The selected role controls access to resources in all relevant APIs.

All roles include permissions for Cloud APIs, as well as Elasticsearch and Kibana APIs. Your API access selection limits the role's scope and can disable core functionality:

• Cloud API access: The API key can use the role’s permissions for organization-level actions in Elastic Cloud, but it has no direct access to the project itself. Roles designed for project use, such as the Security Tier 1 analyst role, have only Viewer access to the relevant projects through Elastic Cloud APIs.

  API keys with custom roles are also limited to Viewer access in the project.

• Cloud, Elasticsearch, and Kibana API access: The API key can use the role’s permissions to fully interact with the project. This selection is required for custom roles to work as intended, because they rely on the Elasticsearch and Kibana serverless APIs for project-level access.

For details on the permissions granted for each role, refer to the predefined roles table.