Check user profile privileges

POST also GET /_security/profile/_has_privileges

Determine whether the users associated with the specified user profile IDs have all the requested privileges.

Note

The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Read the reference documentation

Required authorization

Authentication

Api key

Authorization: <value>

Elasticsearch APIs support key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

To get API keys, use the /_security/api_key APIs.

Basic

Authorization: Basic <credentials>

Bearer

Authorization: Bearer <token>

Elasticsearch APIs support the use of bearer tokens in the Authorization HTTP header to authenticate with the API. For examples, refer to Token-based authentication services

Request body

uids string[] required: A list of profile IDs. The privileges are checked for associated users of the profiles.
privileges object required: An object containing all the privileges to be checked.

Response

application/json

Examples

Request Console 1 / 8 languages

Run POST /_security/profile/_has_privileges to check whether the two users associated with the specified profiles have all the requested set of cluster, index, and application privileges.

Console Kibana Dev Tools

POST /_security/profile/_has_privileges
{
  "uids": [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0"
  ],
  "privileges": {
    "cluster": [ "monitor", "create_snapshot", "manage_ml" ],
    "index" : [
      {
        "names": [ "suppliers", "products" ],
        "privileges": [ "create_doc"]
      },
      {
        "names": [ "inventory" ],
        "privileges" : [ "read", "write" ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges" : [ "read", "data:write/inventory" ],
        "resources" : [ "product/1852563" ]
      }
    ]
  }
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.hasPrivilegesUserProfile({
  uids: [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0",
  ],
  privileges: {
    cluster: ["monitor", "create_snapshot", "manage_ml"],
    index: [
      {
        names: ["suppliers", "products"],
        privileges: ["create_doc"],
      },
      {
        names: ["inventory"],
        privileges: ["read", "write"],
      },
    ],
    application: [
      {
        application: "inventory_manager",
        privileges: ["read", "data:write/inventory"],
        resources: ["product/1852563"],
      },
    ],
  },
});

Python Elasticsearch Python Client

resp = client.security.has_privileges_user_profile(
    uids=[
        "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
        "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
        "u_does-not-exist_0"
    ],
    privileges={
        "cluster": [
            "monitor",
            "create_snapshot",
            "manage_ml"
        ],
        "index": [
            {
                "names": [
                    "suppliers",
                    "products"
                ],
                "privileges": [
                    "create_doc"
                ]
            },
            {
                "names": [
                    "inventory"
                ],
                "privileges": [
                    "read",
                    "write"
                ]
            }
        ],
        "application": [
            {
                "application": "inventory_manager",
                "privileges": [
                    "read",
                    "data:write/inventory"
                ],
                "resources": [
                    "product/1852563"
                ]
            }
        ]
    },
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/profile/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }'

Java Elasticsearch Java Client

client.security().hasPrivilegesUserProfile(h -> h
    .privileges(p -> p
        .application(a -> a
            .application("inventory_manager")
            .privileges(List.of("read","data:write/inventory"))
            .resources("product/1852563")
        )
        .cluster(List.of("monitor","create_snapshot","manage_ml"))
        .index(List.of(IndexPrivilegesCheck.of(i -> i
                .names(List.of("suppliers","products"))
                .privileges("create_doc")),IndexPrivilegesCheck.of(i -> i
                .names("inventory")
                .privileges(List.of("read","write")))))
    )
    .uids(List.of("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0","u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1","u_does-not-exist_0"))
);

C# Elasticsearch .NET Client

var response = await client.Security
    .HasPrivilegesUserProfileAsync(d1 => d1
        .Privileges(d2 => d2
            .Application(d3 => d3
                .Application("inventory_manager")
                .Privileges("read", "data:write/inventory")
                .Resources("product/1852563")
            )
            .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.CreateSnapshot, ClusterPrivilege.ManageMl)
            .Index(d3 => d3
                .Names(new[] { "suppliers", "products" })
                .Privileges(IndexPrivilege.CreateDoc), d3 => d3
                .Names(new[] { "inventory" })
                .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
            )
        )
        .Uids("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->hasPrivilegesUserProfile([
    "body" => [
        "uids" => array(
            "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
            "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
            "u_does-not-exist_0",
        ),
        "privileges" => [
            "cluster" => array(
                "monitor",
                "create_snapshot",
                "manage_ml",
            ),
            "index" => array(
                [
                    "names" => array(
                        "suppliers",
                        "products",
                    ),
                    "privileges" => array(
                        "create_doc",
                    ),
                ],
                [
                    "names" => array(
                        "inventory",
                    ),
                    "privileges" => array(
                        "read",
                        "write",
                    ),
                ],
            ),
            "application" => array(
                [
                    "application" => "inventory_manager",
                    "privileges" => array(
                        "read",
                        "data:write/inventory",
                    ),
                    "resources" => array(
                        "product/1852563",
                    ),
                ],
            ),
        ],
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.has_privileges_user_profile(
  body: {
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }
)

Response

A response from POST /_security/profile/_has_privileges that indicates only one of the three users has all the privileges and one of them is not found.

{
  "has_privilege_uids": ["u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1"],
  "errors": {
    "count": 1,
    "details": {
      "u_does-not-exist_0": {
        "type": "resource_not_found_exception",
        "reason": "profile document not found"
      }
    }
  }
}

Required authorization

Authentication

Request body { }

Response

Request body