Create user-managed service accounts
- PUT /_security/service/{namespace}/{service}
Create a service account in a namespace of your own, or replace one that already exists.
A replacement is not a partial update: every write applies the defaults, so an account that was disabled and is then written again without enabled comes back enabled.
Creating an account whose name still has leftover service tokens is rejected. Delete those tokens first.
NOTE: The elastic namespace is reserved for the built-in service accounts that ship with Elasticsearch.
The manage_service_account privilege does not authorize this API.
- Cluster privileges:
manage_security
Path Parameters
-
namespacestringrequired -
The namespace, which is a top-level grouping of service accounts. It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters. It cannot be
elastic, which is reserved for built-in service accounts. -
servicestringrequired -
The service name. It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters.
Query Parameters
-
refreshRefresh · default: wait_for If
wait_for(the default) then wait for a refresh to make this operation visible to search, iftruethen refresh the affected shards to make this operation visible to search, iffalsethen do nothing with refreshes.-
Values:
truefalsewait_for
Request
-
rolesstringrequired -
The names of the roles to grant to the service account, up to a maximum of 1000. The roles are resolved when the account authenticates, so they do not have to exist yet.
-
enabledboolean · default: true -
Whether the account can authenticate. Tokens can still be created for a disabled account; they just cannot be used until the account is enabled.
-
descriptionstring -
A free-text description of the account, as sent on the last PUT of the account. It has no meaning to Elasticsearch. Absent when the account has no description.