Create or update roles

Base URL
https://{kibana_url}
  • POST /api/security/roles
Auth

Create or update multiple Kibana roles in a single request.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

roles map string to object required
<string> object
description string · max length: 2048

A description for the role.

elasticsearch object required

The Elasticsearch cluster, index, and remote cluster security privileges for the role.

cluster string[] · max items: 100
global object

Global privileges for the role.

application object
manage object
applications string[] · max items: 1000 required
data_source object[] · max items: 1000
names string[] · min items: 1 · max items: 100 required
privileges enum[] · min items: 1 · max items: 5 required

The data source privileges that role members have for the specified data sources.

Values: create read_metadata delete read manage
profile object
write object
applications string[] · max items: 1000 required
role object

Global role privileges.

indices object[] · max items: 1000
allow_restricted_indices boolean

Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.

field_security map string to string
<string> string[] · max items: 1000
names string[] · min items: 1 · max items: 100 required
privileges string[] · min items: 1 · max items: 100 required
query string

A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.

remote_cluster object[] · max items: 100
clusters string[] · min items: 1 · max items: 100 required
privileges string[] · min items: 1 · max items: 100 required
remote_indices object[] · max items: 1000
allow_restricted_indices boolean

Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.

clusters string[] · min items: 1 · max items: 100 required
field_security map string to string
<string> string[] · max items: 1000
names string[] · min items: 1 · max items: 100 required
privileges string[] · min items: 1 · max items: 100 required
query string

A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.

run_as string[] · max items: 100
kibana object[] · max items: 1000
base union string[] required
One of: string[]
feature map string to string
<string> string[] · max items: 100
spaces union enum[] | string[] · default: [ "*" ]
Values: *
metadata map string to object

Response

Indicates a successful call.

application/json
created string[]
errors map string to object
<string> object
reason string required

A human readable error reason.

type string required

The error type.

noop string[]
updated string[]
Base URL
https://{kibana_url}