Elastic Stack

Elastic Stack (ELK Stack) Security API

The security API from Elastic Stack (ELK Stack) — 64 operation(s) for security.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 100

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /_encryption/_reset Reset the project encryption key · Reset the project encryption key #
Ask an LLM
“How do I recover when the project encryption key can no longer be read from disk?”
“What data is lost if I destroy and regenerate the project encryption key?”
Tell an agent destructive · confirm first
Reset the project encryption key, confirming data loss with {accept_data_loss}.
Destroy the current PEK and generate a new one; accept_data_loss is {accept_data_loss}.
POST /_security/profile/_activate Activate a user profile for another user · Activate a user profile #
Ask an LLM
“How does Kibana create or refresh a user profile on behalf of a user who just logged in?”
“Can a profile be activated with a username and password instead of an access token?”
Tell an agent
Activate the user profile for {username} using grant type {grant_type}.
Activate a profile from access token {access_token} with grant type {grant_type}.
GET /_security/_authenticate See who I'm authenticated as · Authenticate a user #
Ask an LLM
“Which user and roles is my current Elasticsearch credential authenticated as?”
“How can I verify that my credentials work and see the realm they come from?”
Tell an agent
Tell me who I'm currently authenticated as.
Show the authenticated user, roles and realm for my current credentials.
GET /_security/role List all native realm roles · Get roles #
Ask an LLM
“Which roles are defined in the native realm?”
“Can I list every role, including the implicit ones?”
Tell an agent
List all roles in the native realm.
Get every role, with include_implicit set to {include_implicit}.
POST /_security/role Create or update many roles at once · Bulk create or update roles #
Ask an LLM
“How do I create several native realm roles in a single request?”
“Can I bulk-update the privileges of multiple roles together?”
Tell an agent
Bulk create or update the roles {roles}.
Upsert these role definitions in one batch: {roles}.
DELETE /_security/role Delete many roles at once · Bulk delete roles #
Ask an LLM
“How do I delete several native realm roles in one call?”
“Can I bulk-remove roles by listing their names?”
Tell an agent destructive · confirm first
Bulk delete the roles {names}.
Remove these roles from the native realm together: {names}.
POST /_security/api_key/_bulk_update Update multiple API keys at once · Bulk update API keys #
Ask an LLM
“How do I apply the same metadata or expiration to many API keys in one request?”
“Can I change the role descriptors on several API keys together?”
Tell an agent
Set expiration {expiration} on API keys {ids}.
Bulk update API keys {ids} with metadata {metadata}.
PUT /_security/user/{username}/_password Change a user's password (PUT) · Change passwords #
Ask an LLM
“How do I reset the password of a specific native realm user?”
“Can I set a user's password from a precomputed hash instead of plain text?”
Tell an agent
Change the password for user {username} to {password}.
Set password hash {password_hash} on user {username}.
POST /_security/user/{username}/_password Change a named user's password via POST · Change passwords #
Ask an LLM
“Is there a POST form of the endpoint for changing a named user's password?”
“Can a built-in user like kibana_system get a new password through a POST call?”
Tell an agent
With POST, give user {username} the new password {password}.
POST a new hashed credential {password_hash} for built-in user {username}.
PUT /_security/user/_password Change my own password (PUT) · Change passwords #
Ask an LLM
“How do I change the password of the user I'm currently logged in as?”
“Can I update my own password without naming my username in the path?”
Tell an agent
Change my own password to {password}.
Replace my current credential with hash {password_hash}.
POST /_security/user/_password Change my own password via POST · Change passwords #
Ask an LLM
“Is there a POST version of changing the password for the logged-in user?”
“Can I refresh the index immediately after changing my own password with a POST request?”
Tell an agent
Using POST, update the password of the current user to {password}.
POST my new password {password} and set refresh to {refresh}.
POST /_security/api_key/{ids}/_clear_cache Clear cached API keys · Clear the API key cache #
Ask an LLM
“How do I evict specific API keys from the API key cache?”
“Can I flush every cached API key at once?”
Tell an agent
Clear the API key cache for keys {ids}.
Evict API key IDs {ids} from the cache.
POST /_security/privilege/{application}/_clear_cache Clear cached application privileges · Clear the privileges cache #
Ask an LLM
“How do I evict an application's privileges from the privilege cache?”
“Why do my application privilege changes not show up until the cache is cleared?”
Tell an agent
Clear the privilege cache for application {application}.
Evict cached privileges of app {application}.
POST /_security/realm/{realms}/_clear_cache Clear the user cache for realms · Clear the user cache #
Ask an LLM
“How do I force a realm to re-authenticate users by clearing its user cache?”
“Can I evict only specific users from a realm's cache?”
Tell an agent
Clear the user cache for realm {realms}.
Evict users {usernames} from the cache of realm {realms}.
POST /_security/role/{name}/_clear_cache Clear cached roles · Clear the roles cache #
Ask an LLM
“How do I evict a role from the native role cache after editing it?”
“Can I clear the role cache for just one role?”
Tell an agent
Clear the role cache for role {name}.
Evict cached role {name} from the native role cache.
POST /_security/service/{namespace}/{service}/credential/token/{name}/_clear_cache Clear service account token caches · Clear service account token caches #
Ask an LLM
“How do I evict a service account token from the token caches?”
“Can I clear cached credentials for one specific service account token?”
Tell an agent
Clear the cache for service token {name} of service {namespace}/{service}.
Evict cached token {name} for {namespace}/{service}.
PUT /_security/api_key/clone Clone an API key (PUT) · Clone an API key #
Ask an LLM
“How do I copy an existing API key so it gets a new ID but the same role descriptors?”
“Can a cloned API key have its own name and expiration?”
Tell an agent
Clone API key {api_key} under the name {name}.
Duplicate key {api_key} with expiration {expiration}.
POST /_security/api_key/clone Clone an API key via POST · Clone an API key #
Ask an LLM
“Is there a POST endpoint to make a copy of an API key with a fresh ID?”
“Does a copied key inherit the source key's permissions?”
Tell an agent
Via POST, create a copy of API key {api_key} called {name}.
POST a clone of {api_key} carrying metadata {metadata}.
GET /_security/api_key Get API key information · Get API key information #
Ask an LLM
“What API keys exist for a given user or realm?”
“Can I list only the API keys that are still active?”
Tell an agent
Get information for API key {id}.
Show the API keys owned by user {username}.
PUT /_security/api_key Create an API key (PUT) · Create an API key #
Ask an LLM
“How do I create an API key so a script can call Elasticsearch without basic auth?”
“Can I restrict a new API key to specific role descriptors?”
Tell an agent
Create an API key named {name} that expires in {expiration}.
Create API key {name} limited to role descriptors {role_descriptors}.
POST /_security/api_key Create an API key via POST · Create an API key #
Ask an LLM
“Is there a POST request for generating a new Elasticsearch API key?”
“Does a newly generated API key never expire unless I set an expiration?”
Tell an agent
Using POST, generate an API key called {name}.
POST a new key {name} with metadata {metadata}.
DELETE /_security/api_key Invalidate API keys · Invalidate API keys #
Ask an LLM
“How do I revoke API keys so they stop authenticating?”
“Can I invalidate all API keys belonging to one user?”
Tell an agent destructive · confirm first
Invalidate API keys {ids}.
Revoke every API key owned by user {username}.
POST /_security/cross_cluster/api_key Create a cross-cluster API key · Create a cross-cluster API key #
Ask an LLM
“How do I create an API key for API key based remote cluster access?”
“Can a cross-cluster key grant both search and replication access?”
Tell an agent
Create cross-cluster API key {name} with access {access}.
Create a remote cluster key {name} granting {access} that expires in {expiration}.
PUT /_security/service/{namespace}/{service}/credential/token/{name} Create a named service account token (PUT) · Create a service account token #
Ask an LLM
“How do I create a named token for a service account like elastic/fleet-server?”
“Can a service account token be used instead of basic authentication?”
Tell an agent
Create service token {name} for service account {namespace}/{service}.
Issue token {name} to {namespace}/{service} with refresh {refresh}.
POST /_security/service/{namespace}/{service}/credential/token/{name} Create a named service account token via POST · Create a service account token #
Ask an LLM
“Is there a POST call for issuing a named service account token?”
“Can I POST to mint a credential with my chosen token name for a service?”
Tell an agent
Using POST, mint token {name} for service {namespace}/{service}.
POST a new credential called {name} under {namespace}/{service}.
DELETE /_security/service/{namespace}/{service}/credential/token/{name} Delete a service account token · Delete service account tokens #
Ask an LLM
“How do I revoke a service account token that was leaked?”
“Can I delete one named token for a service account?”
Tell an agent destructive · confirm first
Delete service token {name} from {namespace}/{service}.
Revoke the {name} token of service account {namespace}/{service}.
POST /_security/service/{namespace}/{service}/credential/token Create an auto-named service account token · Create a service account token #
Ask an LLM
“Can Elasticsearch generate a service account token with an automatically assigned name?”
“How do I get a token for a service account without choosing a token name?”
Tell an agent
Create an auto-named token for service account {namespace}/{service}.
Generate a token with a system-assigned name for {namespace}/{service}.
POST /_security/delegate_pki Exchange a PKI certificate chain for a token · Delegate PKI authentication #
Ask an LLM
“How do I exchange a client X.509 certificate chain for an Elasticsearch access token?”
“Can a proxy that terminates TLS delegate PKI authentication to Elasticsearch?”
Tell an agent
Delegate PKI authentication for certificate chain {x509_certificate_chain}.
Get an access token from X.509 chain {x509_certificate_chain}.
GET /_security/privilege/{application}/{name} Get one application privilege · Get application privileges #
Ask an LLM
“What actions does a specific named privilege of my application grant?”
“Can I look up a single application privilege by application and name?”
Tell an agent
Get privilege {name} of application {application}.
Show the actions granted by {application} privilege {name}.
DELETE /_security/privilege/{application}/{name} Delete application privileges · Delete application privileges #
Ask an LLM
“How do I remove an application privilege I no longer use?”
“Can I delete a single privilege from an application?”
Tell an agent destructive · confirm first
Delete privilege {name} from application {application}.
Remove application privilege {application}/{name}.
GET /_security/role/{name} Get a specific role · Get roles #
Ask an LLM
“What cluster and index privileges does a particular role grant?”
“Can I look up one role by name in the native realm?”
Tell an agent
Show the role {name}.
Get the privileges defined in role {name}.
PUT /_security/role/{name} Create or update a role (PUT) · Create or update roles #
Ask an LLM
“How do I create a role that grants read access to certain indices?”
“Can a role include remote cluster index privileges?”
Tell an agent
Create role {name} with index privileges {indices}.
Update role {name} to grant cluster privileges {cluster}.
POST /_security/role/{name} Create or update a role via POST · Create or update roles #
Ask an LLM
“Is there a POST request for defining a single native realm role?”
“Can I give a role a description and run_as permissions?”
Tell an agent
Via POST, define role {name} with description {description}.
POST role {name} allowing run_as for {run_as}.
DELETE /_security/role/{name} Delete a role · Delete roles #
Ask an LLM
“How do I remove a single role from the native realm?”
“What happens to users assigned a role after I delete it?”
Tell an agent destructive · confirm first
Delete role {name}.
Remove the native realm role {name}.
GET /_security/role_mapping/{name} Get a role mapping · Get role mappings #
Ask an LLM
“Which roles does a specific role mapping assign, and to which users?”
“Can I look up one role mapping by name?”
Tell an agent
Show role mapping {name}.
Get the rules and roles of mapping {name}.
PUT /_security/role_mapping/{name} Create or update a role mapping (PUT) · Create or update role mappings #
Ask an LLM
“How do I map LDAP or SAML users to Elasticsearch roles?”
“Can a role mapping assign roles through templates instead of fixed names?”
Tell an agent
Create role mapping {name} assigning roles {roles} to users matching {rules}.
Update mapping {name} and set enabled to {enabled}.
POST /_security/role_mapping/{name} Create or update a role mapping via POST · Create or update role mappings #
Ask an LLM
“Is there a POST endpoint for defining which roles a group of users receives?”
“Can I POST a mapping that uses role templates?”
Tell an agent
Via POST, create role mapping {name} with role templates {role_templates}.
POST mapping {name} granting {roles}.
DELETE /_security/role_mapping/{name} Delete a role mapping · Delete role mappings #
Ask an LLM
“How do I remove a role mapping so users stop receiving its roles?”
“Can I delete one role mapping by name?”
Tell an agent destructive · confirm first
Delete role mapping {name}.
Remove the mapping {name} that assigns roles to users.
GET /_security/user/{username} Get a specific user · Get users #
Ask an LLM
“What roles and details does a particular native realm user have?”
“Can I see a user's profile UID along with their account?”
Tell an agent
Show user {username}.
Get user {username} including profile uid: {with_profile_uid}.
PUT /_security/user/{username} Create or update a user (PUT) · Create or update users #
Ask an LLM
“How do I add a new user to the native realm with a password and roles?”
“Can I update a user's roles without changing their password?”
Tell an agent
Create user {username} with password {password} and roles {roles}.
Update user {username}'s email to {email}.
POST /_security/user/{username} Create or update a user via POST · Create or update users #
Ask an LLM
“Is there a POST request for adding a native realm user?”
“Can I set a user's full name and metadata when creating them?”
Tell an agent
Via POST, add user {username} with full name {full_name}.
POST user {username} assigned the roles {roles}.
DELETE /_security/user/{username} Delete a user · Delete users #
Ask an LLM
“How do I delete a user from the native realm?”
“Can a deleted native user be restored afterwards?”
Tell an agent destructive · confirm first
Delete user {username}.
Remove native realm user {username} permanently.
PUT /_security/user/{username}/_disable Disable a user (PUT) · Disable users #
Ask an LLM
“How do I block a native user from logging in without deleting them?”
“Can I disable a built-in user account?”
Tell an agent
Disable user {username}.
Prevent {username} from authenticating by disabling the account.
POST /_security/user/{username}/_disable Disable a user via POST · Disable users #
Ask an LLM
“Is there a POST call for turning off a native realm account?”
“Can I POST to deactivate an account and refresh right away?”
Tell an agent
Using POST, deactivate account {username}.
POST a disable for {username} with refresh {refresh}.
PUT /_security/profile/{uid}/_disable Disable a user profile (PUT) · Disable a user profile #
Ask an LLM
“How do I hide a user profile from user profile searches?”
“Can I disable a profile by its UID?”
Tell an agent
Disable user profile {uid}.
Hide profile {uid} from profile suggestions.
POST /_security/profile/{uid}/_disable Disable a user profile via POST · Disable a user profile #
Ask an LLM
“Is there a POST request to make a profile invisible in searches?”
“Can I POST to deactivate a Kibana user profile?”
Tell an agent
Using POST, deactivate profile {uid}.
POST a disable for Kibana profile {uid} with refresh {refresh}.
PUT /_security/user/{username}/_enable Enable a user (PUT) · Enable users #
Ask an LLM
“How do I re-enable a native user account that was disabled?”
“Can I let a disabled built-in user log in again?”
Tell an agent
Enable user {username}.
Restore login access for disabled account {username}.
POST /_security/user/{username}/_enable Enable a user via POST · Enable users #
Ask an LLM
“Is there a POST call for reactivating a disabled native account?”
“Can I POST to turn a user back on and refresh immediately?”
Tell an agent
Using POST, reactivate user {username}.
POST an enable for {username} with refresh {refresh}.
PUT /_security/profile/{uid}/_enable Enable a user profile (PUT) · Enable a user profile #
Ask an LLM
“How do I make a disabled user profile visible in profile searches again?”
“Can I re-enable a profile by its UID?”
Tell an agent
Enable user profile {uid}.
Make profile {uid} show up in profile suggestions again.
POST /_security/profile/{uid}/_enable Enable a user profile via POST · Enable a user profile #
Ask an LLM
“Is there a POST request to reactivate a hidden profile?”
“Can I POST to turn a Kibana user profile back on?”
Tell an agent
Using POST, reactivate profile {uid}.
POST an enable for Kibana profile {uid} with refresh {refresh}.
GET /_security/enroll/kibana Enroll a Kibana instance · Enroll Kibana #
Ask an LLM
“How does a new Kibana instance get the credentials it needs to talk to a secured cluster?”
“What does the Kibana enrollment call return?”
Tell an agent
Enroll a Kibana instance with this cluster.
Get the enrollment credentials and CA for a new Kibana.
GET /_security/enroll/node Enroll a new node into the cluster · Enroll a node #
Ask an LLM
“How do I add a new node to a cluster that has security enabled?”
“What certificates does a node receive when it enrolls?”
Tell an agent
Enroll a new node into this secured cluster.
Get the transport certificates a new node needs to join.
GET /_security/privilege/_builtin List built-in privileges · Get builtin privileges #
Ask an LLM
“Which cluster and index privileges are available in this Elasticsearch version?”
“Where can I see every built-in privilege name?”
Tell an agent
List all built-in cluster and index privileges.
Show the built-in privilege names available in this version.
GET /_security/privilege List all application privileges · Get application privileges #
Ask an LLM
“Which application privileges are defined across all applications?”
“Can I see every application privilege at once?”
Tell an agent
List all application privileges.
Show every application privilege defined on the cluster.
PUT /_security/privilege Create or update application privileges (PUT) · Create or update application privileges #
Ask an LLM
“How do I define custom privileges for my own application?”
“Can I add several application privileges in a single request?”
Tell an agent
Create or update application privileges with refresh {refresh}.
Add the application privileges I describe and refresh with {refresh}.
POST /_security/privilege Create or update application privileges via POST · Create or update application privileges #
Ask an LLM
“Is there a POST form of the endpoint for defining app privileges?”
“Can I POST custom privilege definitions for several applications together?”
Tell an agent
Using POST, upsert app privileges, refresh set to {refresh}.
POST my privilege definitions for my applications.
GET /_security/privilege/{application} List privileges for one application · Get application privileges #
Ask an LLM
“Which privileges are defined for a specific application?”
“Can I list all privileges for just my app?”
Tell an agent
List the privileges of application {application}.
Show every privilege defined for app {application}.
GET /_security/role_mapping List all role mappings · Get role mappings #
Ask an LLM
“Which role mappings are configured on this cluster?”
“Can I see every mapping of users to roles at once?”
Tell an agent
List all role mappings.
Show every role mapping with its rules.
GET /_security/service/{namespace}/{service} Get one service account · Get service accounts #
Ask an LLM
“What role descriptor does a specific service account have?”
“Can I look up a service account by namespace and service name?”
Tell an agent
Get service account {namespace}/{service}.
Show the role descriptor of service {namespace}/{service}.
GET /_security/service/{namespace} List service accounts in a namespace · Get service accounts #
Ask an LLM
“Which service accounts exist in a given namespace?”
“Can I list all service accounts under the elastic namespace?”
Tell an agent
List service accounts in namespace {namespace}.
Show every service account under {namespace}.
GET /_security/service List all service accounts · Get service accounts #
Ask an LLM
“Which service accounts are available in Elasticsearch?”
“Can I see every service account across all namespaces?”
Tell an agent
List all service accounts.
Show every service account across namespaces.
GET /_security/service/{namespace}/{service}/credential List a service account's credentials · Get service account credentials #
Ask an LLM
“Which tokens exist for a specific service account?”
“Can I see both index-backed and file-backed tokens for a service?”
Tell an agent
List credentials for service account {namespace}/{service}.
Show all tokens issued to {namespace}/{service}.
GET /_security/settings Get security index settings · Get security index settings #
Ask an LLM
“What user-configurable settings are applied to the .security index?”
“Can I check the replica settings of the security system indices?”
Tell an agent
Show the security index settings.
Get settings for the .security indices, waiting {master_timeout} for the master.
PUT /_security/settings Update security index settings · Update security index settings #
Ask an LLM
“How do I change the number of replicas for the .security index?”
“Can I update settings for the security profile and tokens indices too?”
Tell an agent
Update the .security index settings to {security}.
Apply settings {security-tokens} to the security tokens index.
GET /_security/stats Get security usage stats · Get security stats #
Ask an LLM
“What security usage statistics do the nodes in my cluster report?”
“Where can I gather security stats from every node?”
Tell an agent
Show security usage statistics for all nodes.
Gather security stats across the cluster.
POST /_security/oauth2/token Get an OAuth2 bearer token · Get a token #
Ask an LLM
“How do I get a bearer access token from Elasticsearch using a username and password?”
“Can I refresh an expired access token with a refresh token?”
Tell an agent
Get a bearer token for user {username} with password {password} using grant type {grant_type}.
Exchange refresh token {refresh_token} for a new access token.
DELETE /_security/oauth2/token Invalidate access or refresh tokens · Invalidate a token #
Ask an LLM
“How do I revoke an access token before it expires?”
“Can I invalidate all tokens issued to a user or realm?”
Tell an agent destructive · confirm first
Invalidate access token {token}.
Revoke every token belonging to user {username}.
GET /_security/user List all users · Get users #
Ask an LLM
“Which users exist in the native realm, including built-in ones?”
“Can I list every user along with their profile IDs?”
Tell an agent
List all users.
Show every user, with profile uid included: {with_profile_uid}.
GET /_security/user/_privileges Get my own privileges · Get user privileges #
Ask an LLM
“What privileges does my logged-in user actually have?”
“Can I see all cluster, index and application privileges granted to me?”
Tell an agent
Show the privileges of the logged-in user.
List everything my current account is allowed to do.
GET /_security/profile/{uid} Get a user profile · Get a user profile #
Ask an LLM
“What does a user profile contain for a given profile ID?”
“Can I fetch only certain application data stored in a profile?”
Tell an agent
Get user profile {uid}.
Show profile {uid} including data {data}.
POST /_security/api_key/grant Grant an API key on behalf of a user · Grant an API key #
Ask an LLM
“How do I create an API key for another user using their credentials?”
“Can I grant an API key from a user's access token instead of a password?”
Tell an agent
Grant API key {api_key} for user {username} using grant type {grant_type}.
Create key {api_key} on behalf of the holder of access token {access_token} with grant type {grant_type}.
GET /_security/user/_has_privileges Check my privileges (GET) · Check user privileges #
Ask an LLM
“Do I have a specific set of cluster or index privileges?”
“How can I test whether my account may write to certain indices?”
Tell an agent
Check whether I have the index privileges {index}.
Test if my account holds cluster privileges {cluster}.
POST /_security/user/_has_privileges Check my privileges via POST · Check user privileges #
Ask an LLM
“Is there a POST version of checking which privileges I hold?”
“Can I verify my application privileges with a POST request?”
Tell an agent
Using POST, verify my application privileges {application}.
POST a check of my own cluster rights {cluster}.
GET /_security/user/{user}/_has_privileges Check a user's privileges (GET) · Check user privileges #
Ask an LLM
“Does a named user have particular index privileges?”
“How can I check another user's cluster privileges by username?”
Tell an agent
Check whether user {user} has index privileges {index}.
Test if {user} holds cluster privileges {cluster}.
POST /_security/user/{user}/_has_privileges Check a user's privileges via POST · Check user privileges #
Ask an LLM
“Is there a POST call for testing a named user's privileges?”
“Can I POST to see if a specific user has certain application privileges?”
Tell an agent
Using POST, verify user {user} has application privileges {application}.
POST a privilege check for {user} on indices {index}.
GET /_security/profile/_has_privileges Check privileges for user profiles (GET) · Check user profile privileges #
Ask an LLM
“Do the users behind a set of profile IDs have the privileges I need?”
“How can Kibana check privileges for many user profiles at once?”
Tell an agent
Check whether profiles {uids} have privileges {privileges}.
Test privileges {privileges} for the users of profile IDs {uids}.
POST /_security/profile/_has_privileges Check privileges for user profiles via POST · Check user profile privileges #
Ask an LLM
“Is there a POST request for checking privileges by profile UID?”
“Can I POST a list of profile UIDs to see which lack a privilege?”
Tell an agent
Using POST, see which of profiles {uids} hold {privileges}.
POST a profile privilege check of {privileges} across {uids}.
POST /_security/oidc/authenticate Complete OpenID Connect authentication · Authenticate OpenID Connect #
Ask an LLM
“How do I exchange an OpenID Connect authentication response for Elasticsearch tokens?”
“What state and nonce values must I send back after the OIDC redirect?”
Tell an agent
Authenticate the OIDC response at {redirect_uri} with state {state} and nonce {nonce}.
Exchange OIDC redirect {redirect_uri} for tokens in realm {realm}, state {state}, nonce {nonce}.
POST /_security/oidc/logout Log out of OpenID Connect · Logout of OpenID Connect #
Ask an LLM
“How do I log a user out of an OpenID Connect session in Elasticsearch?”
“Does OIDC logout invalidate the refresh token as well?”
Tell an agent destructive · confirm first
Log out of OIDC and invalidate access token {token}.
End the OpenID Connect session for {token} and refresh token {refresh_token}.
POST /_security/oidc/prepare Prepare an OpenID Connect login request · Prepare OpenID connect authentication #
Ask an LLM
“How do I build the OpenID Connect authentication URL to redirect a user to?”
“Can I pass a login hint when starting an OIDC login?”
Tell an agent
Prepare an OIDC authentication request for realm {realm}.
Build the OIDC login URL for issuer {iss} with login hint {login_hint}.
GET /_security/_query/api_key Search API keys with a query (GET) · Find API keys with a query #
Ask an LLM
“How can I find API keys matching a query, such as those expiring soon?”
“Can I paginate and sort through API keys?”
Tell an agent
Find API keys matching {query}.
Search API keys sorted by {sort}, returning {size} results.
POST /_security/_query/api_key Search API keys with a query via POST · Find API keys with a query #
Ask an LLM
“Is there a POST endpoint for querying API keys with aggregations?”
“Can I aggregate API keys by owner or status?”
Tell an agent
Using POST, query API keys with aggregations {aggregations}.
POST an API key search for {query} starting at offset {from}.
GET /_security/_query/role Search roles with a query (GET) · Find roles with a query #
Ask an LLM
“How can I find native roles whose description or name matches a query?”
“Can I page through roles in sorted order?”
Tell an agent
Find roles matching {query}.
Page through roles sorted by {sort}, {size} at a time.
POST /_security/_query/role Search roles with a query via POST · Find roles with a query #
Ask an LLM
“Is there a POST call for querying Elasticsearch native roles?”
“Can I continue a role search after a given sort value?”
Tell an agent
Using POST, query native roles for {query}.
POST a role search continuing after {search_after}.
GET /_security/_query/user Search users with a query (GET) · Find users with a query #
Ask an LLM
“How can I find native users matching a query such as enabled status or role?”
“Can I page through users in sorted order?”
Tell an agent
Find users matching {query}.
Page through users sorted by {sort}, {size} per page.
POST /_security/_query/user Search users with a query via POST · Find users with a query #
Ask an LLM
“Is there a POST endpoint for querying native realm users?”
“Can I include profile UIDs when searching users?”
Tell an agent
Using POST, query native users for {query}.
POST a user search including profile uid {with_profile_uid}.
POST /_security/saml/authenticate Submit a SAML response to log in · Authenticate SAML #
Ask an LLM
“How does a custom web app exchange a SAML response for Elasticsearch tokens?”
“Which request IDs must accompany a SAML response?”
Tell an agent
Authenticate SAML response {content} for request IDs {ids}.
Consume SAML response {content} in realm {realm} matching {ids}.
POST /_security/saml/complete_logout Verify a SAML logout response · Logout of SAML completely #
Ask an LLM
“How do I finish a SAML logout by verifying the IdP's logout response?”
“Can the logout response be passed as a query string?”
Tell an agent
Complete SAML logout in realm {realm} for request IDs {ids}.
Verify the IdP logout query string {query_string} for realm {realm} and IDs {ids}.
POST /_security/saml/invalidate Process an IdP-initiated SAML logout · Invalidate SAML #
Ask an LLM
“How do I handle a SAML LogoutRequest sent by the identity provider?”
“What does Elasticsearch return after consuming an IdP logout request?”
Tell an agent destructive · confirm first
Invalidate SAML sessions from logout request query {query_string}.
Consume IdP LogoutRequest {query_string} for realm {realm}.
POST /_security/saml/logout Log out of a SAML session · Logout of SAML #
Ask an LLM
“How do I log a user out of SAML and invalidate their Elasticsearch tokens?”
“Will a SAML logout give me a redirect URL for the IdP?”
Tell an agent destructive · confirm first
Log out of SAML and invalidate token {token}.
End the SAML session for {token} with refresh token {refresh_token}.
POST /_security/saml/prepare Prepare a SAML authentication request · Prepare SAML authentication #
Ask an LLM
“How do I generate the SAML AuthnRequest URL to redirect a user to the IdP?”
“Can I attach a relay state to a SAML login?”
Tell an agent
Prepare a SAML authentication request for realm {realm}.
Build the SAML AuthnRequest URL for ACS {acs} with relay state {relay_state}.
GET /_security/saml/metadata/{realm_name} Generate SAML service provider metadata · Create SAML service provider metadata #
Ask an LLM
“How do I get the SAML metadata XML to give my identity provider?”
“Can I generate SP metadata for one SAML realm?”
Tell an agent
Generate SAML service provider metadata for realm {realm_name}.
Get the SP metadata XML of SAML realm {realm_name}.
GET /_security/profile/_suggest Suggest user profiles (GET) · Suggest a user profile #
Ask an LLM
“How can I find user profiles whose names match what someone is typing?”
“Can profile suggestions favour certain users with a hint?”
Tell an agent
Suggest user profiles matching {name}.
Return {size} profile suggestions for the name {name}.
POST /_security/profile/_suggest Suggest user profiles via POST · Suggest a user profile #
Ask an LLM
“Is there a POST request for profile autocomplete suggestions?”
“Can I POST a hint to boost particular profile UIDs in suggestions?”
Tell an agent
Using POST, suggest profiles for {name} boosted by hint {hint}.
POST a profile autocomplete query for {name}.
PUT /_security/api_key/{id} Update an API key · Update an API key #
Ask an LLM
“How do I change the permissions or expiration of one existing API key?”
“Can I update the metadata on an API key I created?”
Tell an agent
Update API key {id} with role descriptors {role_descriptors}.
Set expiration {expiration} on API key {id}.
PUT /_security/cross_cluster/api_key/{id} Update a cross-cluster API key · Update a cross-cluster API key #
Ask an LLM
“How do I change the remote access granted by a cross-cluster API key?”
“Can I extend the expiration of a cross-cluster key?”
Tell an agent
Update cross-cluster API key {id} with access {access}.
Change cross-cluster key {id} to access {access} and expire in {expiration}.
PUT /_security/profile/{uid}/_data Update user profile data (PUT) · Update user profile data #
Ask an LLM
“How do I store application data or labels on a user profile?”
“Can I guard a profile update with sequence number concurrency control?”
Tell an agent
Update profile {uid} with data {data}.
Set labels {labels} on user profile {uid}.
POST /_security/profile/{uid}/_data Update user profile data via POST · Update user profile data #
Ask an LLM
“Is there a POST request for writing labels onto a Kibana profile?”
“Can I POST profile data only if the sequence number still matches?”
Tell an agent
Using POST, write data {data} to profile {uid} if seq_no is {if_seq_no}.
POST new labels {labels} for Kibana profile {uid}.
GET /_ssl/certificates Get SSL certificate information · Get SSL certificates #
Ask an LLM
“Which X.509 certificates is my cluster using to encrypt communications?”
“When do the SSL certificates on my Elasticsearch nodes expire?”
Tell an agent
Show the SSL certificates used by the cluster.
List TLS certificates on this node with their expiry dates.
POST /api/security/role/_query Query Kibana roles · Query roles #
Ask an LLM
“How do I search Kibana roles with filters, paging and sorting?”
“Can I find Kibana roles matching a text query?”
Tell an agent
Query Kibana roles for {query}.
List Kibana roles matching filters {filters}, {size} per page.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elk Stack Security API
  version: ''
  x-refined-note:
  - x-doc-license differs across the merged source definitions and was not carried
  - x-feedbackLink differs across the merged source definitions and was not carried
  description: 'Operations tagged security across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
tags:


# --- truncated at 32 KB (905 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-api-openapi.yml