---
type: api
title: Get service account credentials
description: To use this API, you must have at least the `read_security` cluster privilege (or a greater privilege such as `manage_service_account` or `manage_security`).
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-get-service-credentials
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-get-service-credentials
products:
  - Elasticsearch
---

# Get service account credentials

Availability: 7.13+

## Paths

- `GET` `/_security/service/{namespace}/{service}/credential`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

#### Path Parameters

- `namespace` (string)
  The name of the namespace.
- `service` (string Name)
  The service name.

## Description

To use this API, you must have at least the `read_security` cluster privilege (or a greater privilege such as `manage_service_account` or `manage_security`).

The response includes service account tokens that were created with the create service account tokens API as well as file-backed tokens from all nodes of the cluster.

NOTE: For tokens backed by the `service_tokens` file, the API collects them from all nodes of the cluster.
Tokens with the same name from different nodes are assumed to be the same token and are only counted once towards the total number of service tokens.

## Required authorization

* Cluster privileges: `read_security`

[More about service accounts](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts)

## Response

`application/json`

- `service_account` (string)
- `count` (number)
- `tokens` (map string to Metadata)
- `nodes_credentials` ({} NodesCredentials)
  Service account credentials collected from all nodes of the cluster.
  - `_nodes` ({} NodeStatistics)
    General status showing how nodes respond to the above collection request
    - `failures` ([] ErrorCause)
      - `type` (string)
        The type of error
      - `reason` (union string) — nullable
        A human-readable explanation of the error, in English.
        One of: `string`
      - `stack_trace` (string)
        The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
      - `caused_by` ({} ErrorCause) — recursive
        Same fields as `failures` in `_nodes`
      - `root_cause` ([] ErrorCause) — recursive
        Same fields as `failures` in `_nodes`
      - `suppressed` ([] ErrorCause) — recursive
        Same fields as `failures` in `_nodes`
    - `total` (number)
      Total number of nodes selected by the request.
    - `successful` (number)
      Number of nodes that responded successfully to the request.
    - `failed` (number)
      Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response.
  - `file_tokens` (map string to NodesCredentialsFileToken)
    File-backed tokens collected from all nodes
    Map values ({} NodesCredentialsFileToken)
    - `nodes` ([] string)
## Code Examples

#### Console

```console
GET /_security/service/elastic/fleet-server/credential
```

#### JavaScript

```javascript
const response = await client.security.getServiceCredentials({
  namespace: "elastic",
  service: "fleet-server",
});
```

#### Python

```python
resp = client.security.get_service_credentials(
    namespace="elastic",
    service="fleet-server",
)
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().getServiceCredentials(g -> g
    .namespace("elastic")
    .service("fleet-server")
);
```

#### C#

```c#
var response = await client.Security.GetServiceCredentialsAsync(@namespace: "elastic", service: "fleet-server");
```

#### PHP

```php
$resp = $client->security()->getServiceCredentials([
    "namespace" => "elastic",
    "service" => "fleet-server",
]);
```

#### Ruby

```ruby
response = client.security.get_service_credentials(
  namespace: "elastic",
  service: "fleet-server"
)
```

## Response Examples

#### Get service credentials response example1

A successful response from `GET /_security/service/elastic/fleet-server/credential`. The response contains all credentials for the `elastic/fleet-server` service account.

```json
{
  "service_account": "elastic/fleet-server",
  "count": 3,
  "tokens": {
    "token1": {},        
    "token42": {}        
  },
  "nodes_credentials": { 
    "_nodes": {          
      "total": 3,
      "successful": 3,
      "failed": 0
    },
    "file_tokens": {      
      "my-token": {
        "nodes": [ "node0", "node1" ] 
      }
    }
  }
}
```