---
type: api
title: Returns user privileges for the Kibana space
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-readprivileges
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-readprivileges
products:
  - Kibana
---

# Returns user privileges for the Kibana space

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/detection_engine/privileges`
- `GET` `/s/{space_id}/api/detection_engine/privileges`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Retrieves whether or not the user is authenticated, and the user's Kibana
space and index privileges, which determine if the user can create an
index for the Elastic Security alerts generated by
detection engine rules.

## Responses

#### `200`

Successful response

`application/json`

- `has_encryption_key` (boolean)
- `is_authenticated` (boolean)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code examples

#### Console

```console
GET kbn:/api/detection_engine/privileges
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/detection_engine/privileges" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### 200

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "has_encryption_key": false,
  "is_authenticated": false
}
```

#### 401

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "error": "string",
  "message": "string",
  "statusCode": 0
}
```

#### 500

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "message": "string",
  "status_code": 0
}
```