Create user-managed service accounts

PUT /_security/service/{namespace}/{service}

Create a service account in a namespace of your own, or replace one that already exists. A replacement is not a partial update: every write applies the defaults, so an account that was disabled and is then written again without enabled comes back enabled.

Creating an account whose name still has leftover service tokens is rejected. Delete those tokens first.

Note

The elastic namespace is reserved for the built-in service accounts that ship with Elasticsearch. The manage_service_account privilege does not authorize this API.

More about service accounts

Required authorization

Authentication

Api key

Authorization: <value>

Elasticsearch APIs support key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

To get API keys, use the /_security/api_key APIs.

Basic

Authorization: Basic <credentials>

Bearer

Authorization: Bearer <token>

Elasticsearch APIs support the use of bearer tokens in the Authorization HTTP header to authenticate with the API. For examples, refer to Token-based authentication services

Request Console 1 / 6 languages

Run PUT /_security/service/my-namespace/my-service to create a service account that is granted the my_role role and can authenticate.

Console Kibana Dev Tools

PUT /_security/service/my-namespace/my-service
{
  "roles": [
    "my_role"
  ],
  "enabled": true
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.putUserManagedServiceAccount({
  namespace: "my-namespace",
  service: "my-service",
  roles: ["my_role"],
  enabled: true,
});

Python Elasticsearch Python Client

resp = client.security.put_user_managed_service_account(
    namespace="my-namespace",
    service="my-service",
    roles=[
        "my_role"
    ],
    enabled=True,
)

curl Shell

curl -X PUT "$ELASTICSEARCH_URL/_security/service/my-namespace/my-service" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "roles": [
      "my_role"
    ],
    "enabled": true
  }'

PHP Elasticsearch PHP Client

$resp = $client->security()->putUserManagedServiceAccount([
    "namespace" => "my-namespace",
    "service" => "my-service",
    "body" => [
        "roles" => array(
            "my_role",
        ),
        "enabled" => true,
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.put_user_managed_service_account(
  namespace: "my-namespace",
  service: "my-service",
  body: {
    "roles": [
      "my_role"
    ],
    "enabled": true
  }
)

Response

A successful response from PUT /_security/service/my-namespace/my-service.

{
  "created": true
}

Create user-managed service accounts

Required authorization

Authentication

Path parameters

Query parameters

Request body

Response

Required authorization

Authentication

Path parameters

Query parameters

Request body { }

Response

Request body