---
type: api
title: Create or update application privileges
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-put-privileges
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-put-privileges
products:
  - Elasticsearch
---

# Create or update application privileges


Availability: 6.4+

## Paths

- `POST` (also `PUT`) `/_security/privilege`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

## Description

To use this API, you must have one of the following privileges:

* The `manage_security` cluster privilege (or a greater privilege such as `all`).
* The "Manage Application Privileges" global privilege for the application being referenced in the request.

Application names are formed from a prefix, with an optional suffix that conform to the following rules:

* The prefix must begin with a lowercase ASCII letter.
* The prefix must contain only ASCII letters or digits.
* The prefix must be at least 3 characters long.
* If the suffix exists, it must begin with either a dash `-` or `_`.
* The suffix cannot contain any of the following characters: `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, `,`, `*`.
* No part of the name can contain whitespace.

Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters `_`, `-`, and `.`.

Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: `/`, `*`, `:`.

## Required authorization

* Cluster privileges: `manage_security`

[About Elasticsearch privileges](https://www.elastic.co/docs/reference/elasticsearch/security-privileges)

## Query String Parameters

- `refresh` (enum Refresh)
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Request Body

`application/json`

Type: `map string to string to Actions`


## Response

`application/json`

Type: `map string to string to CreatedStatus`

## Code Examples

#### Console

```console
POST /_security/privilege
{
  "myapp": {
    "read": {
      "actions": [ 
        "data:read/*" , 
        "action:login" ],
        "metadata": { 
          "description": "Read access to myapp"
        }
      }
    }
}
```

#### JavaScript

```javascript
const response = await client.security.putPrivileges({
  privileges: {
    myapp: {
      read: {
        actions: ["data:read/*", "action:login"],
        metadata: {
          description: "Read access to myapp",
        },
      },
    },
  },
});
```

#### Python

```python
resp = client.security.put_privileges(
    privileges={
        "myapp": {
            "read": {
                "actions": [
                    "data:read/*",
                    "action:login"
                ],
                "metadata": {
                    "description": "Read access to myapp"
                }
            }
        }
    },
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/privilege" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "myapp": {
      "read": {
        "actions": [
          "data:read/*",
          "action:login"
        ],
        "metadata": {
          "description": "Read access to myapp"
        }
      }
    }
  }'
```

#### Java

```java
client.security().putPrivileges(p -> p
    .privileges("myapp", Map.of("read", Actions.of(a -> a
            .actions(List.of("data:read/*","action:login"))
            .metadata("description", JsonData.fromJson("\"Read access to myapp\""))
        )))
);
```

#### C#

```c#
var response = await client.Security
    .PutPrivilegesAsync(d1 => d1
        .Privileges(new Dictionary<string, IDictionary<string,PrivilegeActions>>()
        {
            { "myapp", new Dictionary<string, PrivilegeActions>()
            {
                { "read", new()
                {
                    Actions = ["data:read/*", "action:login"],
                    Metadata = new Dictionary<string, object>()
                    {
                        { "description", "Read access to myapp" }
                    }
                } }
            } }
        })
    );
```

#### PHP

```php
$resp = $client->security()->putPrivileges([
    "body" => [
        "myapp" => [
            "read" => [
                "actions" => array(
                    "data:read/*",
                    "action:login",
                ),
                "metadata" => [
                    "description" => "Read access to myapp",
                ],
            ],
        ],
    ],
]);
```

#### Ruby

```ruby
response = client.security.put_privileges(
  body: {
    "myapp": {
      "read": {
        "actions": [
          "data:read/*",
          "action:login"
        ],
        "metadata": {
          "description": "Read access to myapp"
        }
      }
    }
  }
)
```

## Response Examples

#### Security put privileges response example1

A successful response from `PUT /_security/privilege`.

```json
{
  "myapp": {
    "read": {
      "created": true 
    }
  }
}
```

#### Security put privileges response example2

A successful response from `PUT /_security/privilege`. The `created` property indicates whether the privileges have been created or updated.

```json
{
  "app02": {
    "all": {
      "created": true
    }
  },
  "app01": {
    "read": {
      "created": true
    },
    "write": {
      "created": true
    }
  }
}
```