Check user privileges

POST also GET /_security/user/{user}/_has_privileges
POST also GET /_security/user/_has_privileges

Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.

About Elasticsearch privileges

Path Parameters

user string Name optional

Username

Leave it out to use /_security/user/_has_privileges.

Request

Response

application/json

Examples

Run POST /_security/user/_has_privileges to check whether the current user has a specific set of cluster, index, and application privileges.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/user/_has_privileges
{
  "cluster": [ "monitor", "manage" ],
  "index" : [
    {
      "names": [ "suppliers", "products" ],
      "privileges": [ "read" ]
    },
    {
      "names": [ "inventory" ],
      "privileges" : [ "read", "write" ]
    }
  ],
  "application": [
    {
      "application": "inventory_manager",
      "privileges" : [ "read", "data:write/inventory" ],
      "resources" : [ "product/1852563" ]
    }
  ]
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.hasPrivileges({
  cluster: ["monitor", "manage"],
  index: [
    {
      names: ["suppliers", "products"],
      privileges: ["read"],
    },
    {
      names: ["inventory"],
      privileges: ["read", "write"],
    },
  ],
  application: [
    {
      application: "inventory_manager",
      privileges: ["read", "data:write/inventory"],
      resources: ["product/1852563"],
    },
  ],
});

Python Elasticsearch Python Client

resp = client.security.has_privileges(
    cluster=[
        "monitor",
        "manage"
    ],
    index=[
        {
            "names": [
                "suppliers",
                "products"
            ],
            "privileges": [
                "read"
            ]
        },
        {
            "names": [
                "inventory"
            ],
            "privileges": [
                "read",
                "write"
            ]
        }
    ],
    application=[
        {
            "application": "inventory_manager",
            "privileges": [
                "read",
                "data:write/inventory"
            ],
            "resources": [
                "product/1852563"
            ]
        }
    ],
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/user/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }'

Java Elasticsearch Java Client

client.security().hasPrivileges(h -> h
    .application(a -> a
        .application("inventory_manager")
        .privileges(List.of("read","data:write/inventory"))
        .resources("product/1852563")
    )
    .cluster(List.of("monitor","manage"))
    .index(List.of(IndexPrivilegesCheck.of(i -> i
            .names(List.of("suppliers","products"))
            .privileges("read")
        ),IndexPrivilegesCheck.of(i -> i
            .names("inventory")
            .privileges(List.of("read","write"))
        )))
);

C# Elasticsearch .NET Client

var response = await client.Security
    .HasPrivilegesAsync(d1 => d1
        .Application(d2 => d2
            .Application("inventory_manager")
            .Privileges("read", "data:write/inventory")
            .Resources("product/1852563")
        )
        .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.Manage)
        .Index(d2 => d2
            .Names(new[] { "suppliers", "products" })
            .Privileges(IndexPrivilege.Read), d2 => d2
            .Names(new[] { "inventory" })
            .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
        )
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->hasPrivileges([
    "body" => [
        "cluster" => array(
            "monitor",
            "manage",
        ),
        "index" => array(
            [
                "names" => array(
                    "suppliers",
                    "products",
                ),
                "privileges" => array(
                    "read",
                ),
            ],
            [
                "names" => array(
                    "inventory",
                ),
                "privileges" => array(
                    "read",
                    "write",
                ),
            ],
        ),
        "application" => array(
            [
                "application" => "inventory_manager",
                "privileges" => array(
                    "read",
                    "data:write/inventory",
                ),
                "resources" => array(
                    "product/1852563",
                ),
            ],
        ),
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.has_privileges(
  body: {
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }
)

Response

{
  "username": "rdeniro",
  "has_all_requested" : false,
  "cluster" : {
    "monitor" : true,
    "manage" : false
  },
  "index" : {
    "suppliers" : {
      "read" : true
    },
    "products" : {
      "read" : true
    },
    "inventory" : {
      "read" : true,
      "write" : false
    }
  },
  "application" : {
    "inventory_manager" : {
      "product/1852563" : {
        "read": false,
        "data:write/inventory": false
      }
    }
  }
}

Path Parameters

Request { application , cluster , index , }

Response

Request