Create user-managed service accounts

Auth

Create a service account in a namespace of your own, or replace one that already exists. A replacement is not a partial update: every write applies the defaults, so an account that was disabled and is then written again without enabled comes back enabled.

Creating an account whose name still has leftover service tokens is rejected. Delete those tokens first.

Note

The elastic namespace is reserved for the built-in service accounts that ship with Elasticsearch. The manage_service_account privilege does not authorize this API.

More about service accounts

Required authorization

Cluster privileges manage_security

Path parameters

namespace string required

The namespace, which is a top-level grouping of service accounts. It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters. It cannot be elastic, which is reserved for built-in service accounts.

service string required

The service name. It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters.

Query parameters

refresh enum · default: wait_for

If wait_for (the default) then wait for a refresh to make this operation visible to search, if true then refresh the affected shards to make this operation visible to search, if false then do nothing with refreshes.

Values: true false wait_for

Request body

roles string[] required

The names of the roles to grant to the service account, up to a maximum of 1000. The roles are resolved when the account authenticates, so they do not have to exist yet.

enabled boolean · default: true

Whether the account can authenticate. Tokens can still be created for a disabled account; they just cannot be used until the account is enabled.

description string

A free-text description of the account, as sent on the last PUT of the account. It has no meaning to Elasticsearch. Absent when the account has no description.

Response

application/json
created boolean required

A successful call returns a JSON structure that shows whether the service account has been created or updated. When an existing service account is replaced, created is set to false.