Check user profile privileges

POST also GET /_security/profile/_has_privileges

Auth

Determine whether the users associated with the specified user profile IDs have all the requested privileges.

Note

The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Read the reference documentation

Required authorization

Cluster privileges read_security

Request body

uids string[] required: A list of profile IDs. The privileges are checked for associated users of the profiles.
privileges object required: An object containing all the privileges to be checked.

Response

application/json

has_privilege_uids string[] required: The subset of the requested profile IDs of the users that have all the requested privileges.
errors object: The subset of the requested profile IDs for which an error was encountered. It does not include the missing profile IDs or the profile IDs of the users that do not have all the requested privileges. This field is absent if empty.

Examples

Request Console 1 / 8 languages

Run POST /_security/profile/_has_privileges to check whether the two users associated with the specified profiles have all the requested set of cluster, index, and application privileges.

Console Kibana Dev Tools

POST /_security/profile/_has_privileges
{
  "uids": [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0"
  ],
  "privileges": {
    "cluster": [ "monitor", "create_snapshot", "manage_ml" ],
    "index" : [
      {
        "names": [ "suppliers", "products" ],
        "privileges": [ "create_doc"]
      },
      {
        "names": [ "inventory" ],
        "privileges" : [ "read", "write" ]
      }
    ],
    "application": [
      {
        "application": "inventory_manager",
        "privileges" : [ "read", "data:write/inventory" ],
        "resources" : [ "product/1852563" ]
      }
    ]
  }
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.hasPrivilegesUserProfile({
  uids: [
    "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
    "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
    "u_does-not-exist_0",
  ],
  privileges: {
    cluster: ["monitor", "create_snapshot", "manage_ml"],
    index: [
      {
        names: ["suppliers", "products"],
        privileges: ["create_doc"],
      },
      {
        names: ["inventory"],
        privileges: ["read", "write"],
      },
    ],
    application: [
      {
        application: "inventory_manager",
        privileges: ["read", "data:write/inventory"],
        resources: ["product/1852563"],
      },
    ],
  },
});

Python Elasticsearch Python Client

resp = client.security.has_privileges_user_profile(
    uids=[
        "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
        "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
        "u_does-not-exist_0"
    ],
    privileges={
        "cluster": [
            "monitor",
            "create_snapshot",
            "manage_ml"
        ],
        "index": [
            {
                "names": [
                    "suppliers",
                    "products"
                ],
                "privileges": [
                    "create_doc"
                ]
            },
            {
                "names": [
                    "inventory"
                ],
                "privileges": [
                    "read",
                    "write"
                ]
            }
        ],
        "application": [
            {
                "application": "inventory_manager",
                "privileges": [
                    "read",
                    "data:write/inventory"
                ],
                "resources": [
                    "product/1852563"
                ]
            }
        ]
    },
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/profile/_has_privileges" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }'

Java Elasticsearch Java Client

client.security().hasPrivilegesUserProfile(h -> h
    .privileges(p -> p
        .application(a -> a
            .application("inventory_manager")
            .privileges(List.of("read","data:write/inventory"))
            .resources("product/1852563")
        )
        .cluster(List.of("monitor","create_snapshot","manage_ml"))
        .index(List.of(IndexPrivilegesCheck.of(i -> i
                .names(List.of("suppliers","products"))
                .privileges("create_doc")),IndexPrivilegesCheck.of(i -> i
                .names("inventory")
                .privileges(List.of("read","write")))))
    )
    .uids(List.of("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0","u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1","u_does-not-exist_0"))
);

C# Elasticsearch .NET Client

var response = await client.Security
    .HasPrivilegesUserProfileAsync(d1 => d1
        .Privileges(d2 => d2
            .Application(d3 => d3
                .Application("inventory_manager")
                .Privileges("read", "data:write/inventory")
                .Resources("product/1852563")
            )
            .Cluster(ClusterPrivilege.Monitor, ClusterPrivilege.CreateSnapshot, ClusterPrivilege.ManageMl)
            .Index(d3 => d3
                .Names(new[] { "suppliers", "products" })
                .Privileges(IndexPrivilege.CreateDoc), d3 => d3
                .Names(new[] { "inventory" })
                .Privileges(IndexPrivilege.Read, IndexPrivilege.Write)
            )
        )
        .Uids("u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0", "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1", "u_does-not-exist_0")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->hasPrivilegesUserProfile([
    "body" => [
        "uids" => array(
            "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
            "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
            "u_does-not-exist_0",
        ),
        "privileges" => [
            "cluster" => array(
                "monitor",
                "create_snapshot",
                "manage_ml",
            ),
            "index" => array(
                [
                    "names" => array(
                        "suppliers",
                        "products",
                    ),
                    "privileges" => array(
                        "create_doc",
                    ),
                ],
                [
                    "names" => array(
                        "inventory",
                    ),
                    "privileges" => array(
                        "read",
                        "write",
                    ),
                ],
            ),
            "application" => array(
                [
                    "application" => "inventory_manager",
                    "privileges" => array(
                        "read",
                        "data:write/inventory",
                    ),
                    "resources" => array(
                        "product/1852563",
                    ),
                ],
            ),
        ],
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.has_privileges_user_profile(
  body: {
    "uids": [
      "u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0",
      "u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1",
      "u_does-not-exist_0"
    ],
    "privileges": {
      "cluster": [
        "monitor",
        "create_snapshot",
        "manage_ml"
      ],
      "index": [
        {
          "names": [
            "suppliers",
            "products"
          ],
          "privileges": [
            "create_doc"
          ]
        },
        {
          "names": [
            "inventory"
          ],
          "privileges": [
            "read",
            "write"
          ]
        }
      ],
      "application": [
        {
          "application": "inventory_manager",
          "privileges": [
            "read",
            "data:write/inventory"
          ],
          "resources": [
            "product/1852563"
          ]
        }
      ]
    }
  }
)

Response

A response from POST /_security/profile/_has_privileges that indicates only one of the three users has all the privileges and one of them is not found.

{
  "has_privilege_uids": ["u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1"],
  "errors": {
    "count": 1,
    "details": {
      "u_does-not-exist_0": {
        "type": "resource_not_found_exception",
        "reason": "profile document not found"
      }
    }
  }
}