--- type: api title: Get service accounts description: **All methods and paths for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/elasticsearch/operation/operation-security-get-service-accounts resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/elasticsearch/operation/operation-security-get-service-accounts products: - Elasticsearch --- # Get service accounts Authentication: required Availability: Generally available since 7.13 ## Paths - `GET` `/_security/service/{namespace}/{service}` - `GET` `/_security/service/{namespace}` - `GET` `/_security/service` #### Path parameters - `namespace` (string) — optional, leave it out to use `/_security/service` The name of the namespace. Omit this parameter to retrieve information about all service accounts. If you omit this parameter, you must also omit the `service` parameter. - `service` (string) — optional, leave it out to use `/_security/service` The service name. Omit this parameter to retrieve information about all service accounts that belong to the specified `namespace`. ## Description Get a list of service accounts that match the provided path parameters. Built-in service accounts ship with Elasticsearch in the `elastic` namespace; user-managed service accounts are created with the put user-managed service account API. NOTE: When `type` is omitted, a request without a namespace reports built-in accounts only, which preserves the response of a whole-cluster listing. A request scoped to a namespace reports both kinds, so an account you created is found without naming its kind. [More about service accounts](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts) ## Required authorization - Cluster privileges: `manage_service_account` ## Query string parameters - `type` (union enum | enum[]) — optional A comma-separated list of the kinds of service account to return. If it is omitted, it defaults to `built_in` when no namespace is given and to `built_in,user_managed` otherwise. Supported values include: - `built_in`: An account that ships with Elasticsearch, in the reserved `elastic` namespace. - `user_managed`: An account created with the put user-managed service account API. Values: `built_in`, `user_managed` - `with_profile_uid` (boolean · default: false) — optional If `true`, each user-managed service account also includes the profile UIDs of the users who created and last replaced it, under the `created_by_profile_uid` and `updated_by_profile_uid` fields. A profile UID is included only for a user who has an activated user profile. ## Response `application/json` Type: `map string to oneOf` ## Code examples #### Console ```console GET /_security/service/elastic/fleet-server ``` #### JavaScript ```javascript const response = await client.security.getServiceAccounts({ namespace: "elastic", service: "fleet-server", }); ``` #### Python ```python resp = client.security.get_service_accounts( namespace="elastic", service="fleet-server", ) ``` #### curl ```curl curl -X GET "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server" \ -H "Authorization: ApiKey $ELASTIC_API_KEY" ``` #### Java ```java client.security().getServiceAccounts(g -> g .namespace("elastic") .service("fleet-server") ); ``` #### C# ```c# var response = await client.Security .GetServiceAccountsAsync(d1 => d1 .Namespace("elastic") .Service("fleet-server") ); ``` #### PHP ```php $resp = $client->security()->getServiceAccounts([ "namespace" => "elastic", "service" => "fleet-server", ]); ``` #### Ruby ```ruby response = client.security.get_service_accounts( namespace: "elastic", service: "fleet-server" ) ``` ## Response examples #### A built-in service account `application/json` A successful response from `GET /_security/service/elastic/fleet-server`. The response contains information about the `elastic/fleet-server` service account. ```json { "elastic/fleet-server": { "type": "built_in", "role_descriptor": { "cluster": [ "monitor", "manage_own_api_key", "read_fleet_secrets" ], "indices": [ { "names": [ "logs-*", "metrics-*", "traces-*", ".logs-endpoint.diagnostic.collection-*", ".logs-endpoint.action.responses-*", ".logs-endpoint.heartbeat-*" ], "privileges": [ "write", "create_index", "auto_configure" ], "allow_restricted_indices": false }, { "names": [ "profiling-*" ], "privileges": [ "read", "write" ], "allow_restricted_indices": false }, { "names": [ "traces-apm.sampled-*" ], "privileges": [ "read", "monitor", "maintenance" ], "allow_restricted_indices": false }, { "names": [ ".fleet-secrets*" ], "privileges": [ "read" ], "allow_restricted_indices": true }, { "names": [ ".fleet-actions*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-agents*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-artifacts*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-enrollment-api-keys*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-policies*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-policies-leader*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-servers*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ ".fleet-fileds*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices": true }, { "names": [ "synthetics-*" ], "privileges": [ "read", "write", "create_index", "auto_configure" ], "allow_restricted_indices": false } ], "applications": [ { "application": "kibana-*", "privileges": [ "reserved_fleet-setup" ], "resources": [ "*" ] } ], "run_as": [], "metadata": {}, "transient_metadata": { "enabled": true } } } } ``` #### User-managed service accounts in a namespace `application/json` A successful response from `GET /_security/service/my-namespace?type=user_managed`. The response contains the user-managed service accounts in the `my-namespace` namespace. The account was created by `alice` and last replaced by `bob` using an API key. ```json { "my-namespace/my-service": { "type": "user_managed", "roles": [ "my_role" ], "enabled": true, "created_by": { "username": "alice", "realm": "ldap1", "realm_type": "ldap" }, "created_at": 1758585600000, "updated_by": { "username": "bob", "realm": "default_native", "realm_type": "native", "api_key": { "id": "VuaCfGcBCdbkQm-e5aOx", "name": "deploy-bot-key" } }, "updated_at": 1758672000000 } } ```