application/json

BodyRequired

  • accessobject Required
    Hide access attributes Show access attributes object
    • replicationarray[object]

      A list of indices permission entries for cross-cluster replication.

      Hide replication attributes Show replication attributes object
    • searcharray[object]

      A list of indices permission entries for cross-cluster search.

      Hide search attributes Show search attributes object
      • field_securityobject
        Hide field_security attributes Show field_security attributes object
        • exceptstring | array[string]
        • grantstring | array[string]

      • namesstring | array[string]

        A list of indices (or index name patterns) to which the permissions in this entry apply.

        One of:
        IndexNamestringarray-2array[string]

      • querystring | object

        While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content.

        Since this is embedded in IndicesPrivileges, the same structure is used for clarity in both contexts.

        One of:
        IndicesPrivilegesQuerystringQueryContainerobjectRoleTemplateQueryobject

        An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

        External documentation
      • allow_restricted_indicesboolean

        Set to true if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the names list, Elasticsearch checks privileges against these indices regardless of the value set for allow_restricted_indices.

  • expirationstring

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

  • metadataobject
    Hide metadata attribute Show metadata attribute object
  • namestring Required

Responses

  • 200 application/json
    Hide response attributes Show response attributes object
    • api_keystring Required

      Generated API key.

    • expirationnumber

      Time unit for milliseconds

    • idstring Required
    • namestring Required
    • encodedstring Required

      API key credentials which is the base64-encoding of the UTF-8 representation of id and api_key joined by a colon (:).

POST /_security/cross_cluster/api_key
POST /_security/cross_cluster/api_key
{
  "name": "my-cross-cluster-api-key",
  "expiration": "1d",   
  "access": {
    "search": [  
      {
        "names": ["logs*"]
      }
    ],
    "replication": [  
      {
        "names": ["archive*"]
      }
    ]
  },
  "metadata": {
    "description": "phase one",
    "environment": {
      "level": 1,
      "trusted": true,
      "tags": ["dev", "staging"]
    }
  }
}
curl \
 --request POST 'http://api.example.com/_security/cross_cluster/api_key' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"name\": \"my-cross-cluster-api-key\",\n  \"expiration\": \"1d\",   \n  \"access\": {\n    \"search\": [  \n      {\n        \"names\": [\"logs*\"]\n      }\n    ],\n    \"replication\": [  \n      {\n        \"names\": [\"archive*\"]\n      }\n    ]\n  },\n  \"metadata\": {\n    \"description\": \"phase one\",\n    \"environment\": {\n      \"level\": 1,\n      \"trusted\": true,\n      \"tags\": [\"dev\", \"staging\"]\n    }\n  }\n}"'
Request example
Run `POST /_security/cross_cluster/api_key` to create a cross-cluster API key.
{
  "name": "my-cross-cluster-api-key",
  "expiration": "1d",   
  "access": {
    "search": [  
      {
        "names": ["logs*"]
      }
    ],
    "replication": [  
      {
        "names": ["archive*"]
      }
    ]
  },
  "metadata": {
    "description": "phase one",
    "environment": {
      "level": 1,
      "trusted": true,
      "tags": ["dev", "staging"]
    }
  }
}
Response examples (200)
A successful response from `POST /_security/service/elastic/fleet-server/credential/token`.
{
  "created": true,
  "token": {
    "name": "Jk5J1HgBuyBK5TpDrdo4",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ"
  }
}