---
type: api
title: Add or remove items from the Elasticsearch resource keystore
description: Adds the specified values to the Elasticsearch keystore, or removes the keys for the unspecified values.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-set-deployment-es-resource-keystore
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-set-deployment-es-resource-keystore
products:
  - Elastic Cloud Enterprise
---

# Add or remove items from the Elasticsearch resource keystore

## Paths

- `PATCH` `/deployments/{deployment_id}/elasticsearch/{ref_id}/keystore`

- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#basicauth)
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#apikey)

#### Path Parameters

- `deployment_id` (string)
  Identifier for the Deployment
- `ref_id` (string)
  User-specified RefId for the Resource (or '_main' if there is only one)

## Description

Adds the specified values to the Elasticsearch keystore, or removes the keys for the unspecified values.

## Query String Parameters

- `validate_only` (boolean · default: false)
  When `true`, does nothing except return the entries' allowlist and reloadability statuses.

## Request Body

`application/json`

The new settings that will be applied to the keystore of the Elasticsearch resource.

- `secrets` (map string to KeystoreSecret) — required
  List of secrets
  Map values ({} KeystoreSecret)
  - `value` (object) — optional
    Value of this setting. This can either be a string or a JSON object that is stored as a JSON string in the keystore. NOTE: When the keystore secret is unspecified, it is removed.
  - `as_file` (boolean) — optional
    Stores the keystore secret as a file. The default is false, which stores the keystore secret as string when value is a plain string, or true when value is an object.
  - `is_allowlisted` (boolean) — optional
    Read-only field, ignored on write. Only returned when calling the set-deployment-es-resource-keystore endpoint with `validate_only=true`. True if this setting/value pair is allowlisted (the allowlist is for informational purposes).
  - `is_reloadable` (boolean) — optional
    Read-only field, ignored on write. Only returned when calling the set-deployment-es-resource-keystore endpoint with `validate_only=true`. True if this setting is reloadable, or if false it requires a cluster restart.

## Responses

#### `200`

The new contents of the Elasticsearch keystore (or the proposed contents if validate_only is true)

`application/json`

- `secrets` (map string to KeystoreSecret)
  List of secrets
  Map values ({} KeystoreSecret)
  - `value` (object)
    Value of this setting. This can either be a string or a JSON object that is stored as a JSON string in the keystore. NOTE: When the keystore secret is unspecified, it is removed.
  - `as_file` (boolean)
    Stores the keystore secret as a file. The default is false, which stores the keystore secret as string when value is a plain string, or true when value is an object.
  - `is_allowlisted` (boolean)
    Read-only field, ignored on write. Only returned when calling the set-deployment-es-resource-keystore endpoint with `validate_only=true`. True if this setting/value pair is allowlisted (the allowlist is for informational purposes).
  - `is_reloadable` (boolean)
    Read-only field, ignored on write. Only returned when calling the set-deployment-es-resource-keystore endpoint with `validate_only=true`. True if this setting is reloadable, or if false it requires a cluster restart.
#### `404`

* The Deployment specified by {deployment_id} cannot be found. (code: `deployments.deployment_not_found`)
* The Resource specified by {ref_id} cannot be found. (code: `deployments.deployment_resource_not_found`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `500`

We have failed you. (code: `deployments.metadata_internal_error`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code Examples

#### Console

```console
PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore
```

#### curl

```curl
curl -X PATCH "/deployments/{deployment_id}/elasticsearch/{ref_id}/keystore"
```