Check user profile privileges

POST also GET /_security/profile/_has_privileges

Determine whether the users associated with the specified user profile IDs have all the requested privileges.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Required authorization

Cluster privileges: read_security

Learn more about user profiles

Request

Response

application/json

Examples

Run POST /_security/profile/_has_privileges to check whether the two users associated with the specified profiles have all the requested set of cluster, index, and application privileges.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/profile/_has_privileges
{
  "uids": [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0"
  ],
  "privileges": {
    "cluster": [ "monitor", "create_snapshot", "manage_ml" ],
    "index" : [
      {
        "names": [ "suppliers", "products" ],
        "privileges": [ "create_doc"]
      },
      {
        "names": [ "inventory" ],
        "privileges" : [ "read", "write" ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges" : [ "read", "data:write/inventory" ],
        "resources" : [ "product/1852563" ]
      }
    ]
  }
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.hasPrivilegesUserProfile({
  uids: [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0",
  ],
  privileges: {
    cluster: ["monitor", "create_snapshot", "manage_ml"],
    index: [
      {
        names: ["suppliers", "products"],
        privileges: ["create_doc"],
      },
      {
        names: ["inventory"],
        privileges: ["read", "write"],
      },
    ],
    application: [
      {
        application: "inventory_manager",
        privileges: ["read", "data:write/inventory"],
        resources: ["product/1852563"],
      },
    ],
  },
});

Python Elasticsearch Python Client

resp = client.security.has_privileges_user_profile(
    uids=[
        "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
        "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
        "u_does-not-exist_0"
    ],
    privileges={
        "cluster": [
            "monitor",
            "create_snapshot",
            "manage_ml"
        ],
        "index": [
            {
                "names": [
                    "suppliers",
                    "products"
                ],
                "privileges": [
                    "create_doc"
                ]
            },
            {
                "names": [
                    "inventory"
                ],
                "privileges": [
                    "read",
                    "write"
                ]
            }
        ],
        "application": [
            {
                "application": "inventory_manager",
                "privileges": [
                    "read",
                    "data:write/inventory"
                ],
                "resources": [
                    "product/1852563"
                ]
            }
        ]
    },
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/profile/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }'

Java Elasticsearch Java Client

client.security().hasPrivilegesUserProfile(h -> h
    .privileges(p -> p
        .application(a -> a
            .application("inventory_manager")
            .privileges(List.of("read","data:write/inventory"))
            .resources("product/1852563")
        )
        .cluster(List.of("monitor","create_snapshot","manage_ml"))
        .index(List.of(IndexPrivilegesCheck.of(i -> i
                .names(List.of("suppliers","products"))
                .privileges("create_doc")
            ),IndexPrivilegesCheck.of(i -> i
                .names("inventory")
                .privileges(List.of("read","write"))
            )))
    )
    .uids(List.of("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0","u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1","u_does-not-exist_0"))
);

C# Elasticsearch .NET Client

var response = await client.Security
    .HasPrivilegesUserProfileAsync(d1 => d1
        .Privileges(d2 => d2
            .Application(d3 => d3
                .Application("inventory_manager")
                .Privileges("read", "data:write/inventory")
                .Resources("product/1852563")
            )
            .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.CreateSnapshot, ClusterPrivilege.ManageMl)
            .Index(d3 => d3
                .Names(new[] { "suppliers", "products" })
                .Privileges(IndexPrivilege.CreateDoc), d3 => d3
                .Names(new[] { "inventory" })
                .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
            )
        )
        .Uids("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->hasPrivilegesUserProfile([
    "body" => [
        "uids" => array(
            "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
            "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
            "u_does-not-exist_0",
        ),
        "privileges" => [
            "cluster" => array(
                "monitor",
                "create_snapshot",
                "manage_ml",
            ),
            "index" => array(
                [
                    "names" => array(
                        "suppliers",
                        "products",
                    ),
                    "privileges" => array(
                        "create_doc",
                    ),
                ],
                [
                    "names" => array(
                        "inventory",
                    ),
                    "privileges" => array(
                        "read",
                        "write",
                    ),
                ],
            ),
            "application" => array(
                [
                    "application" => "inventory_manager",
                    "privileges" => array(
                        "read",
                        "data:write/inventory",
                    ),
                    "resources" => array(
                        "product/1852563",
                    ),
                ],
            ),
        ],
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.has_privileges_user_profile(
  body: {
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }
)

Response

{
  "has_privilege_uids": ["u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1"],
  "errors": {
    "count": 1,
    "details": {
      "u_does-not-exist_0": {
        "type": "resource_not_found_exception",
        "reason": "profile document not found"
      }
    }
  }
}

Required authorization

Request { uids , privileges , }

Response

Request