--- type: api title: Check user profile privileges description: **All methods and paths for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-has-privileges-user-profile resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-has-privileges-user-profile products: - Elasticsearch --- # Check user profile privileges Availability: 8.3+ ## Paths - `POST` (also `GET`) `/_security/profile/_has_privileges` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth) - [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth) ## Description Determine whether the users associated with the specified user profile IDs have all the requested privileges. NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` [Learn more about user profiles](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/user-profiles) ## Request Body `application/json` - `uids` ([] string) — required A list of profile IDs. The privileges are checked for associated users of the profiles. - `privileges` ({} PrivilegesCheck) — required An object containing all the privileges to be checked. - `application` ([] ApplicationPrivilegesCheck) — optional - `application` (string) — required The name of the application. - `privileges` ([] string) — required A list of the privileges that you want to check for the specified resources. It may be either application privilege names or the names of actions that are granted by those privileges - `resources` ([] string) — required A list of resource names against which the privileges should be checked. - `cluster` ([] union ClusterPrivilege) — optional A list of the cluster privileges that you want to check. Values: `all`, `cancel_task`, `clone_api_key`, `create_snapshot`, `cross_cluster_replication`, `cross_cluster_search`, `delegate_pki`, `grant_api_key`, `manage`, `manage_api_key`, `manage_autoscaling`, `manage_behavioral_analytics`, `manage_ccr`, `manage_data_frame_transforms`, `manage_data_stream_global_retention`, `manage_enrich`, `manage_esql`, `manage_ilm`, `manage_index_templates`, `manage_inference`, `manage_ingest_pipelines`, `manage_logstash_pipelines`, `manage_ml`, `manage_oidc`, `manage_own_api_key`, `manage_pipeline`, `manage_reindex`, `manage_rollup`, `manage_saml`, `manage_search_application`, `manage_search_query_rules`, `manage_search_synonyms`, `manage_security`, `manage_service_account`, `manage_slm`, `manage_token`, `manage_transform`, `manage_user_profile`, `manage_watcher`, `monitor`, `monitor_data_frame_transforms`, `monitor_data_stream_global_retention`, `monitor_enrich`, `monitor_esql`, `monitor_inference`, `monitor_ml`, `monitor_reindex`, `monitor_rollup`, `monitor_snapshot`, `monitor_stats`, `monitor_text_structure`, `monitor_transform`, `monitor_watcher`, `none`, `post_behavioral_analytics_event`, `read_ccr`, `read_fleet_secrets`, `read_ilm`, `read_pipeline`, `read_security`, `read_slm`, `transport_client`, `write_connector_secrets`, `write_fleet_secrets` - `index` ([] IndexPrivilegesCheck) — optional - `names` (string Indices) — required A list of indices. - `privileges` ([] union IndexPrivilege) — required A list of the privileges that you want to check for the specified indices. Values: `all`, `auto_configure`, `create`, `create_doc`, `create_index`, `create_view`, `cross_cluster_replication`, `cross_cluster_replication_internal`, `delete`, `delete_index`, `delete_view`, `index`, `maintenance`, `manage`, `manage_data_stream_lifecycle`, `manage_follow_index`, `manage_ilm`, `manage_leader_index`, `manage_view`, `monitor`, `none`, `read`, `read_cross_cluster`, `read_view_metadata`, `view_index_metadata`, `write` - `allow_restricted_indices` (boolean) — optional This needs to be set to `true` (default is `false`) if using wildcards or regexps for patterns that cover restricted indices. Implicitly, restricted indices do not match index patterns because restricted indices usually have limited privileges and including them in pattern tests would render most such tests false. If restricted indices are explicitly included in the names list, privileges will be checked against them regardless of the value of `allow_restricted_indices`. ## Response `application/json` - `has_privilege_uids` ([] string) The subset of the requested profile IDs of the users that have all the requested privileges. - `errors` ({} HasPrivilegesUserProfileErrors) The subset of the requested profile IDs for which an error was encountered. It does not include the missing profile IDs or the profile IDs of the users that do not have all the requested privileges. This field is absent if empty. - `count` (number) - `details` (map string to ErrorCause) Map values ({} ErrorCause) - `type` (string) The type of error - `reason` (union string) — nullable A human-readable explanation of the error, in English. One of: `string` - `stack_trace` (string) The server stack trace. Present only if the `error_trace=true` parameter was sent with the request. - `caused_by` ({} ErrorCause) — recursive - `root_cause` ([] ErrorCause) — recursive - `suppressed` ([] ErrorCause) — recursive ## Code Examples #### Console ```console POST /_security/profile/_has_privileges { "uids": [ "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0" ], "privileges": { "cluster": [ "monitor", "create_snapshot", "manage_ml" ], "index" : [ { "names": [ "suppliers", "products" ], "privileges": [ "create_doc"] }, { "names": [ "inventory" ], "privileges" : [ "read", "write" ] } ], "application": [ { "application": "inventory_manager", "privileges" : [ "read", "data:write/inventory" ], "resources" : [ "product/1852563" ] } ] } } ``` #### JavaScript ```javascript const response = await client.security.hasPrivilegesUserProfile({ uids: [ "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0", ], privileges: { cluster: ["monitor", "create_snapshot", "manage_ml"], index: [ { names: ["suppliers", "products"], privileges: ["create_doc"], }, { names: ["inventory"], privileges: ["read", "write"], }, ], application: [ { application: "inventory_manager", privileges: ["read", "data:write/inventory"], resources: ["product/1852563"], }, ], }, }); ``` #### Python ```python resp = client.security.has_privileges_user_profile( uids=[ "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0" ], privileges={ "cluster": [ "monitor", "create_snapshot", "manage_ml" ], "index": [ { "names": [ "suppliers", "products" ], "privileges": [ "create_doc" ] }, { "names": [ "inventory" ], "privileges": [ "read", "write" ] } ], "application": [ { "application": "inventory_manager", "privileges": [ "read", "data:write/inventory" ], "resources": [ "product/1852563" ] } ] }, ) ``` #### curl ```curl curl -X POST "$ELASTICSEARCH_URL/_security/profile/_has_privileges" \ -H "Authorization: ApiKey $ELASTIC_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "uids": [ "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0" ], "privileges": { "cluster": [ "monitor", "create_snapshot", "manage_ml" ], "index": [ { "names": [ "suppliers", "products" ], "privileges": [ "create_doc" ] }, { "names": [ "inventory" ], "privileges": [ "read", "write" ] } ], "application": [ { "application": "inventory_manager", "privileges": [ "read", "data:write/inventory" ], "resources": [ "product/1852563" ] } ] } }' ``` #### Java ```java client.security().hasPrivilegesUserProfile(h -> h .privileges(p -> p .application(a -> a .application("inventory_manager") .privileges(List.of("read","data:write/inventory")) .resources("product/1852563") ) .cluster(List.of("monitor","create_snapshot","manage_ml")) .index(List.of(IndexPrivilegesCheck.of(i -> i .names(List.of("suppliers","products")) .privileges("create_doc") ),IndexPrivilegesCheck.of(i -> i .names("inventory") .privileges(List.of("read","write")) ))) ) .uids(List.of("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0","u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1","u_does-not-exist_0")) ); ``` #### C# ```c# var response = await client.Security .HasPrivilegesUserProfileAsync(d1 => d1 .Privileges(d2 => d2 .Application(d3 => d3 .Application("inventory_manager") .Privileges("read", "data:write/inventory") .Resources("product/1852563") ) .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.CreateSnapshot, ClusterPrivilege.ManageMl) .Index(d3 => d3 .Names(new[] { "suppliers", "products" }) .Privileges(IndexPrivilege.CreateDoc), d3 => d3 .Names(new[] { "inventory" }) .Privileges(IndexPrivilege.Read, IndexPrivilege.Write) ) ) .Uids("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0") ); ``` #### PHP ```php $resp = $client->security()->hasPrivilegesUserProfile([ "body" => [ "uids" => array( "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0", ), "privileges" => [ "cluster" => array( "monitor", "create_snapshot", "manage_ml", ), "index" => array( [ "names" => array( "suppliers", "products", ), "privileges" => array( "create_doc", ), ], [ "names" => array( "inventory", ), "privileges" => array( "read", "write", ), ], ), "application" => array( [ "application" => "inventory_manager", "privileges" => array( "read", "data:write/inventory", ), "resources" => array( "product/1852563", ), ], ), ], ], ]); ``` #### Ruby ```ruby response = client.security.has_privileges_user_profile( body: { "uids": [ "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0" ], "privileges": { "cluster": [ "monitor", "create_snapshot", "manage_ml" ], "index": [ { "names": [ "suppliers", "products" ], "privileges": [ "create_doc" ] }, { "names": [ "inventory" ], "privileges": [ "read", "write" ] } ], "application": [ { "application": "inventory_manager", "privileges": [ "read", "data:write/inventory" ], "resources": [ "product/1852563" ] } ] } } ) ``` ## Response Examples #### Has privileges user profile response example1 A response from `POST /_security/profile/_has_privileges` that indicates only one of the three users has all the privileges and one of them is not found. ```json { "has_privilege_uids": ["u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1"], "errors": { "count": 1, "details": { "u_does-not-exist_0": { "type": "resource_not_found_exception", "reason": "profile document not found" } } } } ```