Get roles
- GET /_security/role/{name}
- GET /_security/role
Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files.
Required authorization
- Cluster privileges read_security
Response
-
<string>object -
clusteranyOfrequired -
Values:
allcancel_taskclone_api_keycreate_snapshotcross_cluster_replicationcross_cluster_searchdelegate_pkigrant_api_keymanagemanage_api_keymanage_autoscalingmanage_behavioral_analyticsmanage_ccrmanage_data_frame_transformsmanage_data_stream_global_retentionmanage_enrichmanage_esqlmanage_ilmmanage_index_templatesmanage_inferencemanage_ingest_pipelinesmanage_logstash_pipelinesmanage_mlmanage_oidcmanage_own_api_keymanage_pipelinemanage_reindexmanage_rollupmanage_samlmanage_search_applicationmanage_search_query_rulesmanage_search_synonymsmanage_securitymanage_service_accountmanage_slmmanage_tokenmanage_transformmanage_user_profilemanage_watchermonitormonitor_data_frame_transformsmonitor_data_stream_global_retentionmonitor_enrichmonitor_esqlmonitor_inferencemonitor_mlmonitor_reindexmonitor_rollupmonitor_snapshotmonitor_statsmonitor_text_structuremonitor_transformmonitor_watchernonepost_behavioral_analytics_eventread_ccrread_fleet_secretsread_ilmread_pipelineread_securityread_slmtransport_clientwrite_connector_secretswrite_fleet_secrets -
indicesobjectrequired -
implicitly_grantedboolean -
Set to
trueon entries that were contributed by a registeredImplicitPrivilegesProviderrather than explicitly stored on the role. Only present when the get role API is called withinclude_implicit=true. The put role API rejects this field, so clients must not echo it back on a GET-then-PUT round-trip. -
field_securityobject -
The document fields that the owners of the role have read access to.
- Reference
-
namesstring | stringrequired -
A list of indices (or index name patterns) to which the permissions in this entry apply.
-
privilegesanyOfrequired -
The index level privileges that owners of the role have on the specified indices.
-
Values:
allauto_configurecreatecreate_doccreate_indexcreate_viewcross_cluster_replicationcross_cluster_replication_internaldeletedelete_indexdelete_viewindexmaintenancemanagemanage_data_stream_lifecyclemanage_follow_indexmanage_ilmmanage_leader_indexmanage_viewmonitornonereadread_cross_clusterread_view_metadataview_index_metadatawrite -
queryunion -
A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
-
allow_restricted_indicesboolean · default: false -
Set to
trueif using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenameslist, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices. -
remote_indicesobject -
field_securityobject -
The document fields that the owners of the role have read access to.
- Reference
-
namesstring | stringrequired -
A list of indices (or index name patterns) to which the permissions in this entry apply.
-
privilegesanyOfrequired -
The index level privileges that owners of the role have on the specified indices.
-
Values:
allauto_configurecreatecreate_doccreate_indexcreate_viewcross_cluster_replicationcross_cluster_replication_internaldeletedelete_indexdelete_viewindexmaintenancemanagemanage_data_stream_lifecyclemanage_follow_indexmanage_ilmmanage_leader_indexmanage_viewmonitornonereadread_cross_clusterread_view_metadataview_index_metadatawrite -
queryunion -
A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
-
allow_restricted_indicesboolean · default: false -
Set to
trueif using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenameslist, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices.