Check user privileges

POST also GET /_security/user/{user}/_has_privileges
POST also GET /_security/user/_has_privileges

Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.

Read the reference documentation

Authentication

Api key

Authorization: <value>

Elasticsearch APIs support key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

To get API keys, use the /_security/api_key APIs.

Basic

Authorization: Basic <credentials>

Bearer

Authorization: Bearer <token>

Elasticsearch APIs support the use of bearer tokens in the Authorization HTTP header to authenticate with the API. For examples, refer to Token-based authentication services

Path parameters

Request body

application object[]
cluster union anyOf[]: A list of the cluster privileges that you want to check.; Values: all cancel_task create_snapshot cross_cluster_replication cross_cluster_search delegate_pki grant_api_key manage manage_api_key manage_autoscaling manage_behavioral_analytics manage_ccr
index object[]

Response

application/json

Examples

Request Console 1 / 8 languages

Run POST /_security/user/_has_privileges to check whether the current user has a specific set of cluster, index, and application privileges.

Console Kibana Dev Tools

POST /_security/user/_has_privileges
{
  "cluster": [ "monitor", "manage" ],
  "index" : [
    {
      "names": [ "suppliers", "products" ],
      "privileges": [ "read" ]
    },
    {
      "names": [ "inventory" ],
      "privileges" : [ "read", "write" ]
    }
  ],
  "application": [
    {
      "application": "inventory_manager",
      "privileges" : [ "read", "data:write/inventory" ],
      "resources" : [ "product/1852563" ]
    }
  ]
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.hasPrivileges({
  cluster: ["monitor", "manage"],
  index: [
    {
      names: ["suppliers", "products"],
      privileges: ["read"],
    },
    {
      names: ["inventory"],
      privileges: ["read", "write"],
    },
  ],
  application: [
    {
      application: "inventory_manager",
      privileges: ["read", "data:write/inventory"],
      resources: ["product/1852563"],
    },
  ],
});

Python Elasticsearch Python Client

resp = client.security.has_privileges(
    cluster=[
        "monitor",
        "manage"
    ],
    index=[
        {
            "names": [
                "suppliers",
                "products"
            ],
            "privileges": [
                "read"
            ]
        },
        {
            "names": [
                "inventory"
            ],
            "privileges": [
                "read",
                "write"
            ]
        }
    ],
    application=[
        {
            "application": "inventory_manager",
            "privileges": [
                "read",
                "data:write/inventory"
            ],
            "resources": [
                "product/1852563"
            ]
        }
    ],
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/user/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }'

Java Elasticsearch Java Client

client.security().hasPrivileges(h -> h
    .application(a -> a
        .application("inventory_manager")
        .privileges(List.of("read","data:write/inventory"))
        .resources("product/1852563")
    )
    .cluster(List.of("monitor","manage"))
    .index(List.of(IndexPrivilegesCheck.of(i -> i
            .names(List.of("suppliers","products"))
            .privileges("read")),IndexPrivilegesCheck.of(i -> i
            .names("inventory")
            .privileges(List.of("read","write")))))
);

C# Elasticsearch .NET Client

var response = await client.Security
    .HasPrivilegesAsync(d1 => d1
        .Application(d2 => d2
            .Application("inventory_manager")
            .Privileges("read", "data:write/inventory")
            .Resources("product/1852563")
        )
        .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.Manage)
        .Index(d2 => d2
            .Names(new[] { "suppliers", "products" })
            .Privileges(IndexPrivilege.Read), d2 => d2
            .Names(new[] { "inventory" })
            .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
        )
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->hasPrivileges([
    "body" => [
        "cluster" => array(
            "monitor",
            "manage",
        ),
        "index" => array(
            [
                "names" => array(
                    "suppliers",
                    "products",
                ),
                "privileges" => array(
                    "read",
                ),
            ],
            [
                "names" => array(
                    "inventory",
                ),
                "privileges" => array(
                    "read",
                    "write",
                ),
            ],
        ),
        "application" => array(
            [
                "application" => "inventory_manager",
                "privileges" => array(
                    "read",
                    "data:write/inventory",
                ),
                "resources" => array(
                    "product/1852563",
                ),
            ],
        ),
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.has_privileges(
  body: {
    "cluster": [
      "monitor",
      "manage"
    ],
    "index": [
      {
        "names": [
          "suppliers",
          "products"
        ],
        "privileges": [
          "read"
        ]
      },
      {
        "names": [
          "inventory"
        ],
        "privileges": [
          "read",
          "write"
        ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges": [
          "read",
          "data:write/inventory"
        ],
        "resources": [
          "product/1852563"
        ]
      }
    ]
  }
)

Response

A successful response from GET /_security/user/_has_privileges, which lists the privileges for the rdeniro user.

{
  "username": "rdeniro",
  "has_all_requested" : false,
  "cluster" : {
    "monitor" : true,
    "manage" : false
  },
  "index" : {
    "suppliers" : {
      "read" : true
    },
    "products" : {
      "read" : true
    },
    "inventory" : {
      "read" : true,
      "write" : false
    }
  },
  "application" : {
    "inventory_manager" : {
      "product/1852563" : {
        "read": false,
        "data:write/inventory": false
      }
    }
  }
}

Authentication

Path parameters

Request body { }

Response

Request body