---
title: stack es security put-user cli command
description: Create or update users. Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/elastic-cli/cli/stack/es/security/put-user
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack es security put-user cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack es security put-user --username <username> [options]
```

Create or update users.
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--username string required">
    An identifier for the user. NOTE: Usernames must be at least 1 and no more than 507 characters.
    They can contain alphanumeric characters (a-z, A-Z, 0-9), spaces, punctuation, and printable symbols in the Basic Latin (ASCII) block.
    Leading or trailing whitespace is not allowed.
  </definition>
  <definition term="--refresh enum">
    Valid values are `true`, `false`, and `wait_for`.
    These values have the same meaning as in the index API, but the default value for this API is true.
    **Values:** true, false, wait_for
  </definition>
  <definition term="--email string">
    The email of the user.
  </definition>
  <definition term="--full-name string">
    The full name of the user.
  </definition>
  <definition term="--metadata string">
    Arbitrary metadata that you want to associate with the user.
  </definition>
  <definition term="--password string">
    The user's password.
    Passwords must be at least 6 characters long.
    When adding a user, one of `password` or `password_hash` is required.
    When updating an existing user, the password is optional, so that other fields on the user (such as their roles) may be updated without modifying the user's password
  </definition>
  <definition term="--password-hash string">
    A hash of the user's password.
    This must be produced using the same hashing algorithm as has been configured for password storage.
    For more details, see the explanation of the `xpack.security.authc.password_hashing.algorithm` setting in the user cache and password hash algorithm documentation.
    Using this parameter allows the client to pre-hash the password for performance and/or confidentiality reasons.
    The `password` parameter and the `password_hash` parameter cannot be used in the same request.
  </definition>
  <definition term="--roles string[]">
    A set of roles the user has.
    The roles determine the user's access permissions.
    To create a user without any roles, specify an empty list (`[]`).
    **Repeatable:** pass `--roles` multiple times to supply more than one value
  </definition>
  <definition term="--enabled">
    Specifies whether the user is enabled.
  </definition>
  <definition term="--error-trace">
    When set to `true` Elasticsearch will include the full stack trace of errors
    when they occur.
  </definition>
  <definition term="--filter-path string">
    Comma-separated list of filters in dot notation which reduce the response
    returned by Elasticsearch.
    **Repeatable:** pass `--filter-path` multiple times to supply more than one value
  </definition>
  <definition term="--human">
    When set to `true` will return statistics in a format suitable for humans.
    For example `"exists_time": "1h"` for humans and
    `"exists_time_in_millis": 3600000` for computers. When disabled the human
    readable values will be omitted. This makes sense for responses being consumed
    only by machines.
  </definition>
  <definition term="--pretty">
    If set to `true` the returned JSON will be "pretty-formatted". Only use
    this option for debugging only.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>