---
type: api
title: Reload the keystore on nodes in the cluster
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-nodes-reload-secure-settings
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-nodes-reload-secure-settings
products:
  - Elasticsearch
---

# Reload the keystore on nodes in the cluster


Availability: 6.5+

## Paths

- `POST` `/_nodes/{node_id}/reload_secure_settings`
- `POST` `/_nodes/reload_secure_settings`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

#### Path Parameters

- `node_id` (union NodeId | [] NodeId) — optional, leave it out to use `/_nodes/reload_secure_settings`
  The names of particular nodes in the cluster to target.

## Description

Secure settings are stored in an on-disk keystore. Certain of these settings are reloadable.
That is, you can change them on disk and reload them without restarting any nodes in the cluster.
When you have updated reloadable secure settings in your keystore, you can use this API to reload those settings on each node.

When the Elasticsearch keystore is password protected and not simply obfuscated, you must provide the password for the keystore when you reload the secure settings.
Reloading the settings for the whole cluster assumes that the keystores for all nodes are protected with the same password; this method is allowed only when inter-node communications are encrypted.
Alternatively, you can reload the secure settings on each node by locally accessing the API and passing the node-specific Elasticsearch keystore password.

## Query String Parameters

- `timeout` (string Duration · default: 30s)
  Period to wait for a response.
If no response is received before the timeout expires, the request fails and returns an error.

## Request Body

`application/json`

- `secure_settings_password` (string) — optional
  The password for the Elasticsearch keystore.

## Response

`application/json`

- `_nodes` ({} NodeStatistics)
  Contains statistics about the number of nodes selected by the request’s node filters.
  - `failures` ([] ErrorCause)
    - `type` (string)
      The type of error
    - `reason` (union string) — nullable
      A human-readable explanation of the error, in English.
      One of: `string`
    - `stack_trace` (string)
      The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
    - `caused_by` ({} ErrorCause) — recursive
      Same fields as `failures` in `_nodes`
    - `root_cause` ([] ErrorCause) — recursive
      Same fields as `failures` in `_nodes`
    - `suppressed` ([] ErrorCause) — recursive
      Same fields as `failures` in `_nodes`
  - `total` (number)
    Total number of nodes selected by the request.
  - `successful` (number)
    Number of nodes that responded successfully to the request.
  - `failed` (number)
    Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response.
- `cluster_name` (string Name)
- `nodes` (map string to NodeReloadResult)
  Map values ({} NodeReloadResult)
  - `name` (string Name)
  - `reload_exception` ({} ErrorCause)
    - `type` (string)
      The type of error
    - `reason` (union string) — nullable
      A human-readable explanation of the error, in English.
      One of: `string`
    - `stack_trace` (string)
      The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
    - `caused_by` ({} ErrorCause) — recursive
      Same fields as `reload_exception` in `nodes`
    - `root_cause` ([] ErrorCause) — recursive
      Same fields as `reload_exception` in `nodes`
    - `suppressed` ([] ErrorCause) — recursive
      Same fields as `reload_exception` in `nodes`
  - `secure_setting_names` ([] string)
    The names of the secure settings that were reloaded.
  - `keystore_path` (string)
    The path to the keystore file.
  - `keystore_digest` (string)
    A SHA-256 hash of the keystore file contents.
  - `keystore_last_modified_time` (DateTime)
    The last modification time of the keystore file.
## Code Examples

#### Console

```console
POST _nodes/reload_secure_settings
{
  "secure_settings_password": "keystore-password"
}
```

#### JavaScript

```javascript
const response = await client.nodes.reloadSecureSettings({
  secure_settings_password: "keystore-password",
});
```

#### Python

```python
resp = client.nodes.reload_secure_settings(
    secure_settings_password="keystore-password",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_nodes/reload_secure_settings" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "secure_settings_password": "keystore-password"
  }'
```

#### Java

```java
client.nodes().reloadSecureSettings(r -> r
    .secureSettingsPassword("keystore-password")
);
```

#### C#

```c#
var response = await client.Nodes
    .ReloadSecureSettingsAsync(d1 => d1
        .SecureSettingsPassword("keystore-password")
    );
```

#### PHP

```php
$resp = $client->nodes()->reloadSecureSettings([
    "body" => [
        "secure_settings_password" => "keystore-password",
    ],
]);
```

#### Ruby

```ruby
response = client.nodes.reload_secure_settings(
  body: {
    "secure_settings_password": "keystore-password"
  }
)
```

## Response Examples

#### Reload secure settings response example1

A successful response when reloading keystore on nodes in your cluster.

```json
{
  "_nodes": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "cluster_name": "my_cluster",
  "nodes": {
    "pQHNt5rXTTWNvUgOrdynKg": {
      "name": "node-0",
      "secure_setting_names": [
        "keystore.seed",
        "xpack.security.transport.ssl.keystore.secure_password",
        "xpack.security.transport.ssl.truststore.secure_password"
      ],
      "keystore_path": "/etc/elasticsearch/elasticsearch.keystore",
      "keystore_digest": "031757c262a50abe1b7e017230cdbab99c1be9fbd7116ff504b27a8787158f46",
      "keystore_last_modified_time": "2025-12-09T22:06:00.408Z"
    }
  }
}
```