Get user privileges
Generally available; Added in 6.5.0
Get the security privileges for the logged in user. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature. To check whether a user has a specific list of privileges, use the has privileges API.
Responses
-
details#setActive"> Hide response attributes Show response attributes object
-
details#setActive"> Hide applications attributes Show applications attributes object
-
The subset of cluster level privileges that can be defined for remote clusters.
-
details#setActive"> Hide global attribute Show global attribute object
-
details#setActive"> Hide indices attributes Show indices attributes object
-
The document fields that the owners of the role have read access to.
External documentation names
string | array[string] Required A list of indices (or index name patterns) to which the permissions in this entry apply.
alternative#change alternative:form->explorer-send-request#updateRequest" data-tabs-scroll="true">One of: tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-indices-names" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-indices-names" tabindex="0"> IndexNamestring tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-indices-array-2-names-array-string" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-indices-array-2-names-array-string" tabindex="0"> array-2array[string] -
The index level privileges that owners of the role have on the specified indices.
-
Search queries that define the documents the user has access to. A document within the specified indices must match these queries for it to be accessible by the owners of the role.
While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content.
Since this is embedded in
IndicesPrivileges
, the same structure is used for clarity in both contexts.While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content.
Since this is embedded in
IndicesPrivileges
, the same structure is used for clarity in both contexts.alternative#change alternative:form->explorer-send-request#updateRequest" data-tabs-scroll="true">One of: tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-indices-query" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-indices-query" tabindex="0"> string-1string tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-indices-query-querycontainer-object" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-indices-query-querycontainer-object" tabindex="0"> QueryContainerobject tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-indices-query-roletemplatequery-object" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-indices-query-roletemplatequery-object" tabindex="0"> RoleTemplateQueryobject An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation -
Set to
true
if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenames
list, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices
.
-
-
details#setActive"> Hide remote_indices attributes Show remote_indices attributes object
-
The document fields that the owners of the role have read access to.
External documentation names
string | array[string] Required A list of indices (or index name patterns) to which the permissions in this entry apply.
alternative#change alternative:form->explorer-send-request#updateRequest" data-tabs-scroll="true">One of: tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-remote_indices-names" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-remote_indices-names" tabindex="0"> IndexNamestring tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-remote_indices-array-2-names-array-string" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-remote_indices-array-2-names-array-string" tabindex="0"> array-2array[string] -
The index level privileges that owners of the role have on the specified indices.
-
Search queries that define the documents the user has access to. A document within the specified indices must match these queries for it to be accessible by the owners of the role.
While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content.
Since this is embedded in
IndicesPrivileges
, the same structure is used for clarity in both contexts.While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content.
Since this is embedded in
IndicesPrivileges
, the same structure is used for clarity in both contexts.alternative#change alternative:form->explorer-send-request#updateRequest" data-tabs-scroll="true">One of: tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-remote_indices-query" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-remote_indices-query" tabindex="0"> string-1string tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-remote_indices-query-querycontainer-object" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-remote_indices-query-querycontainer-object" tabindex="0"> QueryContainerobject tabs#change click->alternative#change " data-tabs-target="tab" href="#operation-security-get-user-privileges-200-body-application-json-remote_indices-query-roletemplatequery-object" role="tab" aria-controls="operation-security-get-user-privileges-200-body-application-json-remote_indices-query-roletemplatequery-object" tabindex="0"> RoleTemplateQueryobject An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation -
Set to
true
if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in thenames
list, Elasticsearch checks privileges against these indices regardless of the value set forallow_restricted_indices
.
-
-
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> Console
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> Python
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> JavaScript
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> Ruby
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> PHP
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> curl
- doc-examples#toggle click->dropdown#hide" data-doc-examples-target="dropdownExample" data-node-id="operation-security-get-user-privileges" role="menuitem"> Java
GET /_security/user/_privileges
resp = client.security.get_user_privileges()
const response = await client.security.getUserPrivileges();
response = client.security.get_user_privileges
$resp = $client->security()->getUserPrivileges();
curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_security/user/_privileges"
client.security().getUserPrivileges(g -> g);
{
"cluster" : [
"all"
],
"global" : [ ],
"indices" : [
{
"names" : [
"*"
],
"privileges" : [
"all"
],
"allow_restricted_indices" : true
}
],
"applications" : [
{
"application" : "*",
"privileges" : [
"*"
],
"resources" : [
"*"
]
}
],
"run_as" : [
"*"
]
}