---
type: api
title: Authenticate a user
description: Authenticates a user and returns information about the authenticated user.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v9/operation/operation-security-authenticate
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v9/operation/operation-security-authenticate
products:
  - Elasticsearch
---

# Authenticate a user

Availability: Generally available since 5.5

## Paths

- `GET` `/_security/_authenticate`

## Description

Authenticates a user and returns information about the authenticated user.
Include the user information in a [basic auth header](https://en.wikipedia.org/wiki/Basic_access_authentication).
A successful call returns a JSON structure that shows user information such as their username, the roles that are assigned to the user, any assigned metadata, and information about the realms that authenticated and authorized the user.
If the user cannot be authenticated, this API returns a 401 status code.

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)

## Response

`application/json`

- `api_key` (object)
  - `id` (string)
  - `name` (string)
  - `managed_by` (enum)
    Values: `cloud`, `elasticsearch`
  - `internal` (boolean)
- `authentication_realm` (object)
  - `name` (string)
  - `type` (string)
- `email` (union string) — nullable
  One of: `string`
- `full_name` (union string) — nullable
- `lookup_realm` (object)
  - `name` (string)
  - `type` (string)
- `metadata` (object)
- `roles` (string[])
- `username` (string)
- `enabled` (boolean)
- `authentication_type` (string)
- `token` (object)
  - `name` (string)
  - `type` (string)
  - `managed_by` (enum)
    Values: `cloud`, `elasticsearch`
## Code examples

#### Console

```console
GET /_security/_authenticate
```

#### JavaScript

```javascript
const response = await client.security.authenticate();
```

#### Python

```python
resp = client.security.authenticate()
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_security/_authenticate" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().authenticate();
```

#### C#

```c#
var response = await client.Security.AuthenticateAsync();
```

#### PHP

```php
$resp = $client->security()->authenticate();
```

#### Ruby

```ruby
response = client.security.authenticate
```

## Response examples

#### Security authenticate response example1

A successful response from `GET /_security/_authenticate`.

```json
{
  "username": "rdeniro",
  "roles": [
    "admin"
  ],
  "full_name": null,
  "email":  null,
  "metadata": { },
  "enabled": true,
  "authentication_realm": {
    "name" : "file",
    "type" : "file"
  },
  "lookup_realm": {
    "name" : "file",
    "type" : "file"
  },
  "authentication_type": "realm"
}
```

#### Security authenticate response example2

A successful response from `GET /_security/_authenticate` for access token authentication.

```json
{
  "username": "0000000001",
  "roles": [
    "admin"
  ],
  "full_name": "Peter Parker",
  "email": "spider-man@marvel.com",
  "metadata": {},
  "enabled": true,
  "authentication_realm": {
    "name": "cloud-saml-kibana",
    "type": "saml"
  },
  "lookup_realm": {
    "name": "cloud-saml-kibana",
    "type": "saml"
  },
  "authentication_type": "token",
  "token": {
    "managed_by": "cloud"
  }
}
```

#### Security authenticate response example3

A successful response from `GET /_security/_authenticate` for service account token authentication.

```json
{
  "username": "elastic/fleet-server",
  "roles": [ ],
  "full_name": "Service account - elastic/fleet-server",
  "email": null,
  "metadata": {
    "_elastic_service_account": true
  },
  "enabled": true,
  "authentication_realm": {
    "name": "_service_account",
    "type": "_service_account"
  },
  "lookup_realm": {
    "name": "_service_account",
    "type": "_service_account"
  },
  "authentication_type": "token",
  "token": {
    "type": "_service_account_index",
    "name": "token_abcd1234",
    "managed_by": "elasticsearch"
  }
}
```