---
type: api
title: Authenticate a user
description: Authenticates a user and returns information about the authenticated user.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch-serverless/operation/operation-security-authenticate
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch-serverless/operation/operation-security-authenticate
products:
  - Elasticsearch Serverless
---

# Authenticate a user

## Paths

- `GET` `/_security/_authenticate`

## Description

Authenticates a user and returns information about the authenticated user.
Include the user information in a [basic auth header](https://en.wikipedia.org/wiki/Basic_access_authentication).
A successful call returns a JSON structure that shows user information such as their username, the roles that are assigned to the user, any assigned metadata, and information about the realms that authenticated and authorized the user.
If the user cannot be authenticated, this API returns a 401 status code.

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs use key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  For more information about where to find API keys for the Elasticsearch endpoint (${ES_URL}) for a project, go to [Get started with Elasticsearch Serverless](https://www.elastic.co/docs/solutions/search/serverless-elasticsearch-get-started).

## Response

`application/json`

- `api_key` (object)
  - `id` (string)
  - `name` (string)
  - `managed_by` (enum)
    Values: `cloud`, `elasticsearch`
  - `internal` (boolean)
- `authentication_realm` (object)
  - `name` (string)
  - `type` (string)
- `email` (union string) — nullable
  One of: `string`
- `full_name` (union string) — nullable
- `lookup_realm` (object)
  - `name` (string)
  - `type` (string)
- `metadata` (object)
- `roles` (string[])
- `username` (string)
- `enabled` (boolean)
- `authentication_type` (string)
- `token` (object)
  - `name` (string)
  - `type` (string)
  - `managed_by` (enum)
    Values: `cloud`, `elasticsearch`
## Code examples

#### Console

```console
GET /_security/_authenticate
```

#### JavaScript

```javascript
const response = await client.security.authenticate();
```

#### Python

```python
resp = client.security.authenticate()
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_security/_authenticate" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().authenticate();
```

#### C#

```c#
var response = await client.Security.AuthenticateAsync();
```

#### PHP

```php
$resp = $client->security()->authenticate();
```

#### Ruby

```ruby
response = client.security.authenticate
```

## Response examples

#### Security authenticate response example1

A successful response from `GET /_security/_authenticate`.

```json
{
  "username": "rdeniro",
  "roles": [
    "admin"
  ],
  "full_name": null,
  "email":  null,
  "metadata": { },
  "enabled": true,
  "authentication_realm": {
    "name" : "file",
    "type" : "file"
  },
  "lookup_realm": {
    "name" : "file",
    "type" : "file"
  },
  "authentication_type": "realm"
}
```

#### Security authenticate response example2

A successful response from `GET /_security/_authenticate` for access token authentication.

```json
{
  "username": "0000000001",
  "roles": [
    "admin"
  ],
  "full_name": "Peter Parker",
  "email": "spider-man@marvel.com",
  "metadata": {},
  "enabled": true,
  "authentication_realm": {
    "name": "cloud-saml-kibana",
    "type": "saml"
  },
  "lookup_realm": {
    "name": "cloud-saml-kibana",
    "type": "saml"
  },
  "authentication_type": "token",
  "token": {
    "managed_by": "cloud"
  }
}
```

#### Security authenticate response example3

A successful response from `GET /_security/_authenticate` for service account token authentication.

```json
{
  "username": "elastic/fleet-server",
  "roles": [ ],
  "full_name": "Service account - elastic/fleet-server",
  "email": null,
  "metadata": {
    "_elastic_service_account": true
  },
  "enabled": true,
  "authentication_realm": {
    "name": "_service_account",
    "type": "_service_account"
  },
  "lookup_realm": {
    "name": "_service_account",
    "type": "_service_account"
  },
  "authentication_type": "token",
  "token": {
    "type": "_service_account_index",
    "name": "token_abcd1234",
    "managed_by": "elasticsearch"
  }
}
```