---
type: api
title: Get service account credentials
description: To use this API, you must have at least the `read_security` cluster privilege (or a greater privilege such as `manage_service_account` or `manage_security`).
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-get-service-credentials
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-get-service-credentials
products:
  - Elasticsearch
---

# Get service account credentials

Availability: Generally available since 7.13

## Paths

- `GET` `/_security/service/{namespace}/{service}/credential`

#### Path parameters

- `namespace` (string) — required
  The name of the namespace.
- `service` (string) — required
  The service name.

## Description

To use this API, you must have at least the `read_security` cluster privilege (or a greater privilege such as `manage_service_account` or `manage_security`).

The response includes service account tokens that were created with the create service account tokens API as well as file-backed tokens from all nodes of the cluster.

NOTE: For tokens backed by the `service_tokens` file, the API collects them from all nodes of the cluster.
Tokens with the same name from different nodes are assumed to be the same token and are only counted once towards the total number of service tokens.

[More about service accounts](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts)

## Required authorization

- Cluster privileges: `read_security`

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)

## Response

`application/json`

- `service_account` (string)
- `count` (number)
- `tokens` (map string to string to object)
- `nodes_credentials` (object)
  Service account credentials collected from all nodes of the cluster.
  - `_nodes` (object)
    General status showing how nodes respond to the above collection request
    - `failures` (object[])
      - `type` (string)
        The type of error
      - `reason` (union string) — nullable
        A human-readable explanation of the error, in English.
        One of: `string`
      - `stack_trace` (string)
        The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
      - `caused_by` (object) — recursive
        Same fields as `failures` in `_nodes`
      - `root_cause` (object[]) — recursive
        Same fields as `failures` in `_nodes`
      - `suppressed` (object[]) — recursive
        Same fields as `failures` in `_nodes`
    - `total` (number)
      Total number of nodes selected by the request.
    - `successful` (number)
      Number of nodes that responded successfully to the request.
    - `failed` (number)
      Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response.
  - `file_tokens` (map string to object)
    File-backed tokens collected from all nodes
    Map values (object)
    - `nodes` (string[])
## Code examples

#### Console

```console
GET /_security/service/elastic/fleet-server/credential
```

#### JavaScript

```javascript
const response = await client.security.getServiceCredentials({
  namespace: "elastic",
  service: "fleet-server",
});
```

#### Python

```python
resp = client.security.get_service_credentials(
    namespace="elastic",
    service="fleet-server",
)
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().getServiceCredentials(g -> g
    .namespace("elastic")
    .service("fleet-server")
);
```

#### C#

```c#
var response = await client.Security.GetServiceCredentialsAsync(@namespace: "elastic", service: "fleet-server");
```

#### PHP

```php
$resp = $client->security()->getServiceCredentials([
    "namespace" => "elastic",
    "service" => "fleet-server",
]);
```

#### Ruby

```ruby
response = client.security.get_service_credentials(
  namespace: "elastic",
  service: "fleet-server"
)
```

## Response examples

#### Get service credentials response example1

A successful response from `GET /_security/service/elastic/fleet-server/credential`. The response contains all credentials for the `elastic/fleet-server` service account.

```json
{
  "service_account": "elastic/fleet-server",
  "count": 3,
  "tokens": {
    "token1": {},        
    "token42": {}        
  },
  "nodes_credentials": { 
    "_nodes": {          
      "total": 3,
      "successful": 3,
      "failed": 0
    },
    "file_tokens": {      
      "my-token": {
        "nodes": [ "node0", "node1" ] 
      }
    }
  }
}
```