---
type: api
title: Create or update roles
description: Create or update multiple Kibana roles in a single request.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-post-security-roles
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-post-security-roles
products:
  - Kibana
---

# Create or update roles

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/security/roles`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Create or update multiple Kibana roles in a single request.

## Request Body

`application/json`

- `roles` (map string to object) — required
  Map values ({})
  - `description` (string · max: 2048) — optional
    A description for the role.
  - `elasticsearch` ({}) — required
    The Elasticsearch cluster, index, and remote cluster security privileges for the role.
    - `cluster` ([] string · max: 100) — optional
    - `global` ({}) — optional
      Global privileges for the role.
      - `application` (object) — optional
        - `manage` (object) — optional
          - `applications` ([] string · max: 1000) — required
      - `data_source` ([] object · max: 1000) — optional
        - `names` ([] string · min: 1 · max: 100) — required
        - `privileges` ([] enum  · min: 1 · max: 5) — required
          The data source privileges that role members have for the specified data sources.
          Values: `create`, `read_metadata`, `delete`, `read`, `manage`
      - `profile` (object) — optional
        - `write` (object) — optional
          - `applications` ([] string · max: 1000) — required
      - `role` (object) — optional
        Global role privileges.
    - `indices` ([] object · max: 1000) — optional
      - `allow_restricted_indices` (boolean) — optional
        Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.
      - `field_security` (map string to string) — optional
      - `names` ([] string · min: 1 · max: 100) — required
      - `privileges` ([] string · min: 1 · max: 100) — required
      - `query` (string) — optional
        A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
    - `remote_cluster` ([] object · max: 100) — optional
      - `clusters` ([] string · min: 1 · max: 100) — required
      - `privileges` ([] string · min: 1 · max: 100) — required
    - `remote_indices` ([] object · max: 1000) — optional
      - `allow_restricted_indices` (boolean) — optional
        Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.
      - `clusters` ([] string · min: 1 · max: 100) — required
      - `field_security` (map string to string) — optional
      - `names` ([] string · min: 1 · max: 100) — required
      - `privileges` ([] string · min: 1 · max: 100) — required
      - `query` (string) — optional
        A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
    - `run_as` ([] string · max: 100) — optional
  - `kibana` ([] object · max: 1000) — optional
    - `base` (union string[]) — required
      One of: `string[]`
    - `feature` (map string to string) — optional
    - `spaces` (union [] enum | [] string · default: [
  "*"
]) — optional
      Values: `*`
  - `metadata` (map string to object) — optional

## Response

Indicates a successful call.

`application/json`

- `created` ([] string)
- `errors` (map string to object)
  Map values ({})
  - `reason` (string)
    A human readable error reason.
  - `type` (string)
    The error type.
- `noop` ([] string)
- `updated` ([] string)
## Code Examples

#### Console

```console
POST /api/security/roles
{
  "roles": {
    "my_kibana_role": {
      "elasticsearch": {
        "cluster": [
          "monitor"
        ],
        "indices": [
          {
            "names": [
              "logs-*"
            ],
            "privileges": [
              "read"
            ]
          }
        ]
      },
      "kibana": [
        {
          "base": [
            "read"
          ],
          "feature": {},
          "spaces": [
            "default"
          ]
        }
      ]
    }
  }
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/security/roles" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "roles": {
    "my_kibana_role": {
      "elasticsearch": {
        "cluster": [
          "monitor"
        ],
        "indices": [
          {
            "names": [
              "logs-*"
            ],
            "privileges": [
              "read"
            ]
          }
        ]
      },
      "kibana": [
        {
          "base": [
            "read"
          ],
          "feature": {},
          "spaces": [
            "default"
          ]
        }
      ]
    }
  }
}'
```

## Response Examples

#### Bulk create or update roles

```json
{
  "created": [
    "my_kibana_role"
  ],
  "noop": [],
  "updated": []
}
```