Create a service account token

POST also PUT /_security/service/{namespace}/{service}/credential/token/{name}
POST /_security/service/{namespace}/{service}/credential/token

Auth

Create a service accounts token for access without requiring basic authentication. This route serves both kinds of service account, but the privileges differ: manage_service_account authorizes tokens of built-in accounts in the elastic namespace only, and tokens of a user-managed account require manage_security.

Note

Service account tokens never expire. You must actively delete them if they are no longer needed.

Important

On Serverless, non-operator users can create tokens for only elastic/fleet-server and elastic/fleet-server-remote. Creating tokens for any other service account requires operator privileges.

More about service accounts

Required privileges

Cluster privileges manage_service_account

Path parameters

namespace string required

The name of the namespace, which is a top-level grouping of service accounts.

service string required

The name of the service.

name string optional

The name for the service account token. If omitted, a random name will be generated.

Token names must be at least one and no more than 256 characters. They can contain alphanumeric characters (a-z, A-Z, 0-9), dashes (-), and underscores (_), but cannot begin with an underscore.

Note

Token names must be unique in the context of the associated service account. They must also be globally unique with their fully qualified names, which are comprised of the service account principal and token name, such as <namespace>/<service>/<token-name>.

Leave it out to use /_security/service/{namespace}/{service}/credential/token.

Query parameters

refresh enum: If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.; Values: true false wait_for

Response

application/json

created boolean required
token object required