Get service accounts
- GET /_security/service/{namespace}/{service}
- GET /_security/service/{namespace}
- GET /_security/service
Get a list of service accounts that match the provided path parameters.
Currently, only the elastic/fleet-server service account is available.
Required authorization
- Cluster privileges manage_service_account
Response
-
<string>object -
role_descriptorobjectrequired -
clusteranyOfrequired -
A list of cluster privileges. These privileges define the cluster level actions that API keys are able to execute.
-
Values:
allcancel_taskclone_api_keycreate_snapshotcross_cluster_replicationcross_cluster_searchdelegate_pkigrant_api_keymanagemanage_api_keymanage_autoscalingmanage_behavioral_analyticsmanage_ccrmanage_data_frame_transformsmanage_data_stream_global_retentionmanage_enrichmanage_esqlmanage_ilmmanage_index_templatesmanage_inferencemanage_ingest_pipelinesmanage_logstash_pipelinesmanage_mlmanage_oidcmanage_own_api_keymanage_pipelinemanage_reindexmanage_rollupmanage_samlmanage_search_applicationmanage_search_query_rulesmanage_search_synonymsmanage_securitymanage_service_accountmanage_slmmanage_tokenmanage_transformmanage_user_profilemanage_watchermonitormonitor_data_frame_transformsmonitor_data_stream_global_retentionmonitor_enrichmonitor_esqlmonitor_inferencemonitor_mlmonitor_reindexmonitor_rollupmonitor_snapshotmonitor_statsmonitor_text_structuremonitor_transformmonitor_watchernonepost_behavioral_analytics_eventread_ccrread_fleet_secretsread_ilmread_pipelineread_securityread_slmtransport_clientwrite_connector_secretswrite_fleet_secrets -
indicesobjectrequired -
A list of indices permissions entries.
-
field_securityobject -
The document fields that the owners of the role have read access to.
- Reference
-
namesstring | stringrequired -
A list of indices (or index name patterns) to which the permissions in this entry apply.
-
privilegesanyOfrequired -
The index level privileges that owners of the role have on the specified indices.
-
Values:
allauto_configurecreatecreate_doccreate_indexcreate_viewcross_cluster_replicationcross_cluster_replication_internaldeletedelete_indexdelete_viewindexmaintenancemanagemanage_data_stream_lifecyclemanage_follow_indexmanage_ilmmanage_leader_indexmanage_viewmonitornonereadread_cross_clusterread_view_metadataview_index_metadatawrite -
queryunion -
A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
-
allow_restricted_indicesboolean · default: false -
Set to
trueif using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenameslist, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices. -
remote_indicesobject -
A list of indices permissions for remote clusters.
-
field_securityobject -
The document fields that the owners of the role have read access to.
- Reference
-
namesstring | stringrequired -
A list of indices (or index name patterns) to which the permissions in this entry apply.
-
privilegesanyOfrequired -
The index level privileges that owners of the role have on the specified indices.
-
Values:
allauto_configurecreatecreate_doccreate_indexcreate_viewcross_cluster_replicationcross_cluster_replication_internaldeletedelete_indexdelete_viewindexmaintenancemanagemanage_data_stream_lifecyclemanage_follow_indexmanage_ilmmanage_leader_indexmanage_viewmonitornonereadread_cross_clusterread_view_metadataview_index_metadatawrite -
queryunion -
A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
-
allow_restricted_indicesboolean · default: false -
Set to
trueif using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenameslist, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices. -
remote_clusterobject -
A list of cluster permissions for remote clusters. NOTE: This is limited a subset of the cluster permissions.
-
globalobject -
An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware.
-
data_sourceobject -
A list of data source privilege entries, used to grant access to ES|QL data sources.
-
namesstringrequired -
A list of data source names or wildcard patterns to which the permissions in this entry apply.
-
privilegesanyOfrequired -
The data source privileges that owners of the role have for the specified data sources.
Supported values include:
create: Grants privilege to create a data source with a matching name.delete: Grants privilege to delete a data source with a matching name.read_metadata: Grants privilege to read a data source's metadata.read: Grants privilege to attach a dataset to a data source with a matching name.manage: Grants all data source privileges, includingcreate,delete,read, andread_metadata.
-
Values:
createdeleteread_metadatareadmanage -
metadataobject -
Optional meta-data. Within the metadata object, keys that begin with
_are reserved for system usage. -
run_asstring -
A list of users that the API keys can impersonate. NOTE: In Elastic Cloud Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty
run_asfield, but a non-empty list will be rejected. - Reference