---
type: api
title: Check user privileges
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-security-has-privileges
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-security-has-privileges
products:
  - Elasticsearch Serverless
---

# Check user privileges


Availability:

## Paths

- `POST` (also `GET`) `/_security/user/{user}/_has_privileges`
- `POST` (also `GET`) `/_security/user/_has_privileges`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/authentication#apikeyauth)

#### Path Parameters

- `user` (string Name) — optional, leave it out to use `/_security/user/_has_privileges`
  Username

## Description

Determine whether the specified user has a specified list of privileges.
All users can use this API, but only to determine their own privileges.
To check the privileges of other users, you must use the run as feature.

[About Elasticsearch privileges](https://www.elastic.co/docs/reference/elasticsearch/security-privileges)

## Request Body

`application/json`

- `application` ([] ApplicationPrivilegesCheck) — optional
  - `application` (string) — required
    The name of the application.
  - `privileges` ([] string) — required
    A list of the privileges that you want to check for the specified resources.
It may be either application privilege names or the names of actions that are granted by those privileges
  - `resources` ([] string) — required
    A list of resource names against which the privileges should be checked.
- `cluster` ([] union ClusterPrivilege) — optional
  A list of the cluster privileges that you want to check.
  Values: `all`, `cancel_task`, `manage`, `manage_api_key`, `manage_behavioral_analytics`, `manage_enrich`, `manage_esql`, `manage_index_templates`, `manage_inference`, `manage_ingest_pipelines`, `manage_logstash_pipelines`, `manage_ml`, `manage_own_api_key`, `manage_pipeline`, `manage_reindex`, `manage_search_application`, `manage_search_query_rules`, `manage_search_synonyms`, `manage_security`, `manage_transform`, `monitor`, `monitor_enrich`, `monitor_esql`, `monitor_inference`, `monitor_ml`, `monitor_reindex`, `monitor_transform`, `none`, `post_behavioral_analytics_event`, `read_pipeline`, `read_security`, `read_project_routing`, `manage_project_routing`
- `index` ([] IndexPrivilegesCheck) — optional
  - `names` (string Indices) — required
    A list of indices.
  - `privileges` ([] union IndexPrivilege) — required
    A list of the privileges that you want to check for the specified indices.
    Values: `all`, `auto_configure`, `create`, `create_doc`, `create_index`, `create_view`, `delete`, `delete_index`, `delete_view`, `index`, `maintenance`, `manage`, `manage_data_stream_lifecycle`, `manage_view`, `monitor`, `none`, `read`, `read_view_metadata`, `view_index_metadata`, `write`
  - `allow_restricted_indices` (boolean) — optional
    This needs to be set to `true` (default is `false`) if using wildcards or regexps for patterns that cover restricted indices.
Implicitly, restricted indices do not match index patterns because restricted indices usually have limited privileges and including them in pattern tests would render most such tests false.
If restricted indices are explicitly included in the names list, privileges will be checked against them regardless of the value of `allow_restricted_indices`.

## Response

`application/json`

- `application` (ApplicationsPrivileges)
- `cluster` (map string to boolean)
- `has_all_requested` (boolean)
- `index` (map string to Privileges)
- `username` (string)
## Code Examples

#### Console

```console
POST /_security/user/_has_privileges
{
  "cluster": [ "monitor", "manage" ],
  "index" : [
    {
      "names": [ "suppliers", "products" ],
      "privileges": [ "read" ]
    },
    {
      "names": [ "inventory" ],
      "privileges" : [ "read", "write" ]
    }
  ],
  "application": [
    {
      "application": "inventory_manager",
      "privileges" : [ "read", "data:write/inventory" ],
      "resources" : [ "product/1852563" ]
    }
  ]
}
```

#### JavaScript

```javascript
const response = await client.security.hasPrivileges({
  cluster: ["monitor", "manage"],
  index: [
    {
      names: ["suppliers", "products"],
      privileges: ["read"],
    },
    {
      names: ["inventory"],
      privileges: ["read", "write"],
    },
  ],
  application: [
    {
      application: "inventory_manager",
      privileges: ["read", "data:write/inventory"],
      resources: ["product/1852563"],
    },
  ],
});
```

#### Python

```python
resp = client.security.has_privileges(
    cluster=[
        "monitor",
        "manage"
    ],
    index=[
        {
            "names": [
                "suppliers",
                "products"
            ],
            "privileges": [
                "read"
            ]
        },
        {
            "names": [
                "inventory"
            ],
            "privileges": [
                "read",
                "write"
            ]
        }
    ],
    application=[
        {
            "application": "inventory_manager",
            "privileges": [
                "read",
                "data:write/inventory"
            ],
            "resources": [
                "product/1852563"
            ]
        }
    ],
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/user/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }'
```

#### Java

```java
client.security().hasPrivileges(h -> h
    .application(a -> a
        .application("inventory_manager")
        .privileges(List.of("read","data:write/inventory"))
        .resources("product/1852563")
    )
    .cluster(List.of("monitor","manage"))
    .index(List.of(IndexPrivilegesCheck.of(i -> i
            .names(List.of("suppliers","products"))
            .privileges("read")
        ),IndexPrivilegesCheck.of(i -> i
            .names("inventory")
            .privileges(List.of("read","write"))
        )))
);
```

#### C#

```c#
var response = await client.Security
    .HasPrivilegesAsync(d1 => d1
        .Application(d2 => d2
            .Application("inventory_manager")
            .Privileges("read", "data:write/inventory")
            .Resources("product/1852563")
        )
        .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.Manage)
        .Index(d2 => d2
            .Names(new[] { "suppliers", "products" })
            .Privileges(IndexPrivilege.Read), d2 => d2
            .Names(new[] { "inventory" })
            .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
        )
    );
```

#### PHP

```php
$resp = $client->security()->hasPrivileges([
    "body" => [
        "cluster" => array(
            "monitor",
            "manage",
        ),
        "index" => array(
            [
                "names" => array(
                    "suppliers",
                    "products",
                ),
                "privileges" => array(
                    "read",
                ),
            ],
            [
                "names" => array(
                    "inventory",
                ),
                "privileges" => array(
                    "read",
                    "write",
                ),
            ],
        ),
        "application" => array(
            [
                "application" => "inventory_manager",
                "privileges" => array(
                    "read",
                    "data:write/inventory",
                ),
                "resources" => array(
                    "product/1852563",
                ),
            ],
        ),
    ],
]);
```

#### Ruby

```ruby
response = client.security.has_privileges(
  body: {
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }
)
```

## Response Examples

#### Security has privileges response example1

A successful response from `GET /_security/user/_has_privileges`, which lists the privileges for the `rdeniro` user.

```json
{
  "username": "rdeniro",
  "has_all_requested" : false,
  "cluster" : {
    "monitor" : true,
    "manage" : false
  },
  "index" : {
    "suppliers" : {
      "read" : true
    },
    "products" : {
      "read" : true
    },
    "inventory" : {
      "read" : true,
      "write" : false
    }
  },
  "application" : {
    "inventory_manager" : {
      "product/1852563" : {
        "read": false,
        "data:write/inventory": false
      }
    }
  }
}
```