Elastic Stack

Elastic Stack (ELK Stack) Security API

The security API from Elastic Stack (ELK Stack) — 64 operation(s) for security.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 100

POST /_encryption/_reset Reset the project encryption key #
POST /_security/profile/_activate Activate a user profile #
GET /_security/_authenticate Authenticate a user #
GET /_security/role Get roles #
POST /_security/role Bulk create or update roles #
DELETE /_security/role Bulk delete roles #
POST /_security/api_key/_bulk_update Bulk update API keys #
PUT /_security/user/{username}/_password Change passwords #
POST /_security/user/{username}/_password Change passwords #
PUT /_security/user/_password Change passwords #
POST /_security/user/_password Change passwords #
POST /_security/api_key/{ids}/_clear_cache Clear the API key cache #
POST /_security/privilege/{application}/_clear_cache Clear the privileges cache #
POST /_security/realm/{realms}/_clear_cache Clear the user cache #
POST /_security/role/{name}/_clear_cache Clear the roles cache #
POST /_security/service/{namespace}/{service}/credential/token/{name}/_clear_cache Clear service account token caches #
PUT /_security/api_key/clone Clone an API key #
POST /_security/api_key/clone Clone an API key #
GET /_security/api_key Get API key information #
PUT /_security/api_key Create an API key #
POST /_security/api_key Create an API key #
DELETE /_security/api_key Invalidate API keys #
POST /_security/cross_cluster/api_key Create a cross-cluster API key #
PUT /_security/service/{namespace}/{service}/credential/token/{name} Create a service account token #
POST /_security/service/{namespace}/{service}/credential/token/{name} Create a service account token #
DELETE /_security/service/{namespace}/{service}/credential/token/{name} Delete service account tokens #
POST /_security/service/{namespace}/{service}/credential/token Create a service account token #
POST /_security/delegate_pki Delegate PKI authentication #
GET /_security/privilege/{application}/{name} Get application privileges #
DELETE /_security/privilege/{application}/{name} Delete application privileges #
GET /_security/role/{name} Get roles #
PUT /_security/role/{name} Create or update roles #
POST /_security/role/{name} Create or update roles #
DELETE /_security/role/{name} Delete roles #
GET /_security/role_mapping/{name} Get role mappings #
PUT /_security/role_mapping/{name} Create or update role mappings #
POST /_security/role_mapping/{name} Create or update role mappings #
DELETE /_security/role_mapping/{name} Delete role mappings #
GET /_security/user/{username} Get users #
PUT /_security/user/{username} Create or update users #
POST /_security/user/{username} Create or update users #
DELETE /_security/user/{username} Delete users #
PUT /_security/user/{username}/_disable Disable users #
POST /_security/user/{username}/_disable Disable users #
PUT /_security/profile/{uid}/_disable Disable a user profile #
POST /_security/profile/{uid}/_disable Disable a user profile #
PUT /_security/user/{username}/_enable Enable users #
POST /_security/user/{username}/_enable Enable users #
PUT /_security/profile/{uid}/_enable Enable a user profile #
POST /_security/profile/{uid}/_enable Enable a user profile #
GET /_security/enroll/kibana Enroll Kibana #
GET /_security/enroll/node Enroll a node #
GET /_security/privilege/_builtin Get builtin privileges #
GET /_security/privilege Get application privileges #
PUT /_security/privilege Create or update application privileges #
POST /_security/privilege Create or update application privileges #
GET /_security/privilege/{application} Get application privileges #
GET /_security/role_mapping Get role mappings #
GET /_security/service/{namespace}/{service} Get service accounts #
GET /_security/service/{namespace} Get service accounts #
GET /_security/service Get service accounts #
GET /_security/service/{namespace}/{service}/credential Get service account credentials #
GET /_security/settings Get security index settings #
PUT /_security/settings Update security index settings #
GET /_security/stats Get security stats #
POST /_security/oauth2/token Get a token #
DELETE /_security/oauth2/token Invalidate a token #
GET /_security/user Get users #
GET /_security/user/_privileges Get user privileges #
GET /_security/profile/{uid} Get a user profile #
POST /_security/api_key/grant Grant an API key #
GET /_security/user/_has_privileges Check user privileges #
POST /_security/user/_has_privileges Check user privileges #
GET /_security/user/{user}/_has_privileges Check user privileges #
POST /_security/user/{user}/_has_privileges Check user privileges #
GET /_security/profile/_has_privileges Check user profile privileges #
POST /_security/profile/_has_privileges Check user profile privileges #
POST /_security/oidc/authenticate Authenticate OpenID Connect #
POST /_security/oidc/logout Logout of OpenID Connect #
POST /_security/oidc/prepare Prepare OpenID connect authentication #
GET /_security/_query/api_key Find API keys with a query #
POST /_security/_query/api_key Find API keys with a query #
GET /_security/_query/role Find roles with a query #
POST /_security/_query/role Find roles with a query #
GET /_security/_query/user Find users with a query #
POST /_security/_query/user Find users with a query #
POST /_security/saml/authenticate Authenticate SAML #
POST /_security/saml/complete_logout Logout of SAML completely #
POST /_security/saml/invalidate Invalidate SAML #
POST /_security/saml/logout Logout of SAML #
POST /_security/saml/prepare Prepare SAML authentication #
GET /_security/saml/metadata/{realm_name} Create SAML service provider metadata #
GET /_security/profile/_suggest Suggest a user profile #
POST /_security/profile/_suggest Suggest a user profile #
PUT /_security/api_key/{id} Update an API key #
PUT /_security/cross_cluster/api_key/{id} Update a cross-cluster API key #
PUT /_security/profile/{uid}/_data Update user profile data #
POST /_security/profile/{uid}/_data Update user profile data #
GET /_ssl/certificates Get SSL certificates #
POST /api/security/role/_query Query roles #

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack-security-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elk Stack Security API
  version: ''
  x-refined-note:
  - x-doc-license differs across the merged source definitions and was not carried
  - x-feedbackLink differs across the merged source definitions and was not carried
  description: 'Operations tagged security across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
tags:


# --- truncated at 32 KB (905 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-api-openapi.yml