Elastic Stack (ELK Stack) Security API

openapi: 3.2.0
info:
  title: Elk Stack Security API
  version: ''
  x-refined-note:
  - x-doc-license differs across the merged source definitions and was not carried
  - x-feedbackLink differs across the merged source definitions and was not carried
  description: 'Operations tagged security across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
tags:
- name: security
paths:
  /_encryption/_reset:
    post:
      tags:
      - security
      summary: Reset the project encryption key
      description: 'Destroy the current project encryption key (PEK) and generate a new one.

        This is the recovery path for when the on-disk encrypted PEK becomes permanently

        inaccessible, for example because the key encryption material protecting it was lost.


        All data that was encrypted under the destroyed key becomes permanently unrecoverable.

        Each feature that stores encrypted data decides how to handle its own data during the

        reset: some features drop the encrypted values entirely, while others preserve the rest

        of the affected data and only clear the values that can no longer be decrypted.


        Because this operation causes permanent data loss, it requires the `accept_data_loss`

        query parameter to be set to `true`.'
      operationId: encryption-reset
      parameters:
      - in: query
        name: accept_data_loss
        description: 'Acknowledge that resetting the project encryption key permanently destroys all data

          that was encrypted under the current key.

          The request fails if this is not set to `true`.'
        required: true
        deprecated: false
        schema:
          type: boolean
        style: form
      - in: query
        name: master_timeout
        description: 'The period to wait for a connection to the master node.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: 'The period to wait for a response.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                EncryptionResetResponseExample1:
                  summary: Reset the project encryption key
                  description: 'A successful response from `POST /_encryption/_reset?accept_data_loss=true`.

                    '
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental; Added in 9.5.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_security/profile/_activate:
    post:
      tags:
      - security
      summary: Activate a user profile
      description: 'Create or update a user profile on behalf of another user.


        NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions.

        Individual users and external applications should not call this API directly.

        The calling application must have either an `access_token` or a combination of `username` and `password` for the user that the profile document is intended for.

        Elastic reserves the right to change or remove this feature in future releases without prior notice.


        This API creates or updates a profile document for end users with information that is extracted from the user''s authentication object including `username`, `full_name,` `roles`, and the authentication realm.

        For example, in the JWT `access_token` case, the profile user''s `username` is extracted from the JWT token claim pointed to by the `claims.principal` setting of the JWT realm that authenticated the token.


        When updating a profile document, the API enables the document if it was disabled.

        Any updates do not change existing content for either the `labels` or `data` fields.


        ## Required authorization


        * Cluster privileges: `manage_user_profile`

        '
      operationId: security-activate-user-profile
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                access_token:
                  description: 'The user''s Elasticsearch access token or JWT.

                    Both `access` and `id` JWT token types are supported and they depend on the underlying JWT realm configuration.

                    If you specify the `access_token` grant type, this parameter is required.

                    It is not valid with other grant types.'
                  type: string
                grant_type:
                  description: The type of grant.
                  allOf:
                  - $ref: '#/components/schemas/security._types.GrantType'
                password:
                  description: 'The user''s password.

                    If you specify the `password` grant type, this parameter is required.

                    It is not valid with other grant types.'
                  type: string
                username:
                  description: 'The username that identifies the user.

                    If you specify the `password` grant type, this parameter is required.

                    It is not valid with other grant types.'
                  type: string
              required:
              - grant_type
            examples:
              ActivateUserProfileRequestExample1:
                description: 'Run `POST /_security/profile/_activate` to activate a user profile.

                  '
                value: "{\n  \"grant_type\": \"password\",\n  \"username\" : \"jacknich\",\n  \"password\" : \"l0ng-r4nd0m-p@ssw0rd\"\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/security._types.UserProfileWithMetadata'
              examples:
                ActivateUserProfileResponseExample1:
                  description: A successful response from `POST /_security/profile/_activate`.
                  value: "{\n  \"uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\",\n  \"enabled\": true,\n  \"last_synchronized\": 1642650651037,\n  \"user\": {\n    \"username\": \"jacknich\",\n    \"roles\": [\n      \"admin\", \"other_role1\"\n    ],\n    \"realm_name\": \"native\",\n    \"full_name\": \"Jack Nicholson\",\n    \"email\": \"jacknich@example.com\"\n  },\n  \"labels\": {},\n  \"data\": {},\n  \"_doc\": {\n    \"_primary_term\": 88,\n    \"_seq_no\": 66\n  }\n}"
      x-state: Generally available; Added in 8.2.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_security/_authenticate:
    get:
      tags:
      - security
      summary: Authenticate a user
      description: 'Authenticates a user and returns information about the authenticated user.

        Include the user information in a [basic auth header](https://en.wikipedia.org/wiki/Basic_access_authentication).

        A successful call returns a JSON structure that shows user information such as their username, the roles that are assigned to the user, any assigned metadata, and information about the realms that authenticated and authorized the user.

        If the user cannot be authenticated, this API returns a 401 status code.'
      operationId: security-authenticate
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  api_key:
                    allOf:
                    - $ref: '#/components/schemas/security.authenticate.AuthenticateApiKey'
                  authentication_realm:
                    allOf:
                    - $ref: '#/components/schemas/security._types.RealmInfo'
                  email:
                    oneOf:
                    - type: string
                    - type:
                      - string
                      - 'null'
                  full_name:
                    oneOf:
                    - $ref: '#/components/schemas/_types.Name'
                    - type:
                      - string
                      - 'null'
                  lookup_realm:
                    allOf:
                    - $ref: '#/components/schemas/security._types.RealmInfo'
                  metadata:
                    allOf:
                    - $ref: '#/components/schemas/_types.Metadata'
                  roles:
                    type: array
                    items:
                      type: string
                  username:
                    allOf:
                    - $ref: '#/components/schemas/_types.Username'
                  enabled:
                    type: boolean
                  authentication_type:
                    type: string
                  token:
                    x-state: Generally available; Added in 7.14.0
                    allOf:
                    - $ref: '#/components/schemas/security.authenticate.Token'
                required:
                - authentication_realm
                - lookup_realm
                - metadata
                - roles
                - username
                - enabled
                - authentication_type
              examples:
                SecurityAuthenticateResponseExample1:
                  description: A successful response from `GET /_security/_authenticate`.
                  value: "{\n  \"username\": \"rdeniro\",\n  \"roles\": [\n    \"admin\"\n  ],\n  \"full_name\": null,\n  \"email\":  null,\n  \"metadata\": { },\n  \"enabled\": true,\n  \"authentication_realm\": {\n    \"name\" : \"file\",\n    \"type\" : \"file\"\n  },\n  \"lookup_realm\": {\n    \"name\" : \"file\",\n    \"type\" : \"file\"\n  },\n  \"authentication_type\": \"realm\"\n}"
                SecurityAuthenticateResponseExample2:
                  description: A successful response from `GET /_security/_authenticate` for access token authentication.
                  value: "{\n  \"username\": \"0000000001\",\n  \"roles\": [\n    \"admin\"\n  ],\n  \"full_name\": \"Peter Parker\",\n  \"email\": \"spider-man@marvel.com\",\n  \"metadata\": {},\n  \"enabled\": true,\n  \"authentication_realm\": {\n    \"name\": \"cloud-saml-kibana\",\n    \"type\": \"saml\"\n  },\n  \"lookup_realm\": {\n    \"name\": \"cloud-saml-kibana\",\n    \"type\": \"saml\"\n  },\n  \"authentication_type\": \"token\",\n  \"token\": {\n    \"managed_by\": \"cloud\"\n  }\n}"
                SecurityAuthenticateResponseExample3:
                  description: A successful response from `GET /_security/_authenticate` for service account token authentication.
                  value: "{\n  \"username\": \"elastic/fleet-server\",\n  \"roles\": [ ],\n  \"full_name\": \"Service account - elastic/fleet-server\",\n  \"email\": null,\n  \"metadata\": {\n    \"_elastic_service_account\": true\n  },\n  \"enabled\": true,\n  \"authentication_realm\": {\n    \"name\": \"_service_account\",\n    \"type\": \"_service_account\"\n  },\n  \"lookup_realm\": {\n    \"name\": \"_service_account\",\n    \"type\": \"_service_account\"\n  },\n  \"authentication_type\": \"token\",\n  \"token\": {\n    \"type\": \"_service_account_index\",\n    \"name\": \"token_abcd1234\",\n    \"managed_by\": \"elasticsearch\"\n  }\n}"
      x-state: Generally available; Added in 5.5.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_security/role:
    get:
      tags:
      - security
      summary: Get roles
      description: 'Get roles in the native realm.

        The role management APIs are generally the preferred way to manage roles, rather than using file-based role management.

        The get roles API cannot retrieve roles that are defined in roles files.


        ## Required authorization


        * Cluster privileges: `read_security`

        '
      operationId: security-get-role-1
      parameters:
      - $ref: '#/components/parameters/security.get_role-include_implicit'
      responses:
        '200':
          $ref: '#/components/responses/security.get_role-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - security
      summary: Bulk create or update roles
      description: 'The role management APIs are generally the preferred way to manage roles, rather than using file-based role management.

        The bulk create or update roles API cannot update roles that are defined in roles files.


        ## Required authorization


        * Cluster privileges: `manage_security`

        '
      operationId: security-bulk-put-role
      parameters:
      - in: query
        name: refresh
        description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Refresh'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                roles:
                  description: A dictionary of role name to RoleDescriptor objects to add or update
                  type: object
                  additionalProperties:
                    $ref: '#/components/schemas/security._types.RoleDescriptor'
              required:
              - roles
            examples:
              SecurityBulkPutRoleRequestExample1:
                summary: Bulk role success
                description: 'Run `POST /_security/role` to add roles called `my_admin_role` and `my_user_role`.

                  '
                value: "{\n  \"roles\": {\n      \"my_admin_role\": {\n          \"cluster\": [\n              \"all\"\n          ],\n          \"indices\": [\n              {\n                  \"names\": [\n                      \"index1\",\n                      \"index2\"\n                  ],\n                  \"privileges\": [\n                      \"all\"\n                  ],\n                  \"field_security\": {\n                      \"grant\": [\n                          \"title\",\n                          \"body\"\n                      ]\n                  },\n                  \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n              }\n          ],\n          \"applications\": [\n              {\n                  \"application\": \"myapp\",\n                  \"privileges\": [\n                      \"admin\",\n                      \"read\"\n                  ],\n                  \"resources\": [\n                      \"*\"\n                  ]\n              }\n          ],\n          \"run_as\": [\n              \"other_user\"\n          ],\n          \"metadata\": {\n              \"version\": 1\n          }\n      },\n      \"my_user_role\": {\n          \"cluster\": [\n              \"all\"\n          ],\n          \"indices\": [\n              {\n                  \"names\": [\n                      \"index1\"\n                  ],\n                  \"privileges\": [\n                      \"read\"\n                  ],\n                  \"field_security\": {\n                      \"grant\": [\n                          \"title\",\n                          \"body\"\n                      ]\n                  },\n                  \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n              }\n          ],\n          \"applications\": [\n              {\n                  \"application\": \"myapp\",\n                  \"privileges\": [\n                      \"admin\",\n                      \"read\"\n                  ],\n                  \"resources\": [\n                      \"*\"\n                  ]\n              }\n          ],\n          \"run_as\": [\n              \"other_user\"\n          ],\n          \"metadata\": {\n              \"version\": 1\n          }\n      }\n  }\n}"
              SecurityBulkPutRoleRequestExample2:
                summary: Bulk role errors
                description: 'Because errors are handled individually for each role create or update, the API allows partial success. For example, `POST /_security/role` would throw an error for `my_admin_role` because the privilege `bad_cluster_privilege` doesn''t exist, but would be successful for the `my_user_role`.

                  '
                value: "{\n  \"roles\": {\n      \"my_admin_role\": {\n          \"cluster\": [\n              \"bad_cluster_privilege\"\n          ],\n          \"indices\": [\n              {\n                  \"names\": [\n                      \"index1\",\n                      \"index2\"\n                  ],\n                  \"privileges\": [\"all\"],\n                  \"field_security\": {\n                      \"grant\": [\n                          \"title\",\n                          \"body\"\n                      ]\n                  },\n                  \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n              }\n          ],\n          \"applications\": [\n              {\n                  \"application\": \"myapp\",\n                  \"privileges\": [\n                      \"admin\",\n                      \"read\"\n                  ],\n                  \"resources\": [\n                      \"*\"\n                  ]\n              }\n          ],\n          \"run_as\": [\n              \"other_user\"\n          ],\n          \"metadata\": {\n              \"version\": 1\n          }\n      },\n      \"my_user_role\": {\n          \"cluster\": [\n              \"all\"\n          ],\n          \"indices\": [\n              {\n                  \"names\": [\n                      \"index1\"\n                  ],\n                  \"privileges\": [\n                      \"read\"\n                  ],\n                  \"field_security\": {\n                      \"grant\": [\n                          \"title\",\n                          \"body\"\n                      ]\n                  },\n                  \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n              }\n          ],\n          \"applications\": [\n              {\n                  \"application\": \"myapp\",\n                  \"privileges\": [\n                      \"admin\",\n                      \"read\"\n                  ],\n                  \"resources\": [\n                      \"*\"\n                  ]\n              }\n          ],\n          \"run_as\": [\n              \"other_user\"\n          ],\n          \"metadata\": {\n              \"version\": 1\n          }\n      }\n  }\n}"
              SecurityBulkPutRoleRequestExample3:
                summary: Role example 3
                description: Run `POST /_security/role/only_remote_access_role` to configure a role with remote indices and remote cluster privileges for a remote cluster.
                value: "{\n  \"remote_indices\": [\n    {\n      \"clusters\": [\"my_remote\"], \n      \"names\": [\"logs*\"], \n      \"privileges\": [\"read\", \"read_cross_cluster\", \"view_index_metadata\"] \n    }\n  ],\n  \"remote_cluster\": [\n    {\n      \"clusters\": [\"my_remote\"], \n      \"privileges\": [\"monitor_stats\"]  \n    }\n  ]\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  created:
                    description: Array of created roles
                    type: array
                    items:
                      type: string
                  updated:
                    description: Array of updated roles
                    type: array
                    items:
                      type: string
                  noop:
                    description: Array of role names without any changes
                    type: array
                    items:
                      type: string
                  errors:
                    description: Present if any updates resulted in errors
                    allOf:
                    - $ref: '#/components/schemas/security._types.BulkError'
              examples:
                SecurityBulkPutRoleResponseExample1:
                  summary: A successful response
                  description: 'A successful response from `POST /_security/role/my_admin_role` returns a JSON structure that shows whether the role has been created, updated, or had no changes made.

                    '
                  value: "{\n    \"created\": [ \n        \"my_admin_role\", \n        \"my_user_role\"\n    ]\n}"
                SecurityBulkPutRoleResponseExample2:
                  summary: A partially successful response
                  description: 'A partially successful response from `POST /_security/role`. Errors are handled individually for each role create or update, thus the API allows partial success. In this example, the creation of the `my_user_role` role succeeds and the `my_admin_role` role fails.

                    '
                  value: "{\n  \"created\": [\n      \"my_user_role\" \n  ],\n  \"errors\": { \n      \"count\": 1, \n      \"details\": {\n          \"my_admin_role\": { \n              \"type\": \"action_request_validation_exception\",\n              \"reason\": \"Validation Failed: 1: unknown cluster privilege [bad_cluster_privilege]. a privilege must be either one of the predefined cluster privilege names [manage_own_api_key,manage_data_stream_global_retention,monitor_data_stream_global_retention,none,cancel_task,cross_cluster_replication,cross_cluster_search,delegate_pki,grant_api_key,manage_autoscaling,manage_index_templates,manage_logstash_pipelines,manage_oidc,manage_saml,manage_search_application,manage_search_query_rules,manage_search_synonyms,manage_service_account,manage_token,manage_user_profile,monitor_connector,monitor_enrich,monitor_inference,monitor_ml,monitor_rollup,monitor_snapshot,monitor_stats,monitor_text_structure,monitor_watcher,post_behavioral_analytics_event,read_ccr,read_connector_secrets,read_fleet_secrets,read_ilm,read_pipeline,read_security,read_slm,transport_client,write_connector_secrets,write_fleet_secrets,create_snapshot,manage_behavioral_analytics,manage_ccr,manage_connector,manage_enrich,manage_ilm,manage_inference,manage_ml,manage_rollup,manage_slm,manage_watcher,monitor_data_frame_transforms,monitor_transform,manage_api_key,manage_ingest_pipelines,manage_pipeline,manage_data_frame_transforms,manage_transform,manage_security,monitor,manage,all] or a pattern over one of the available cluster actions;\"\n          }\n      }\n  }\n}"
      x-state: Generally available; Added in 8.15.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - security
      summary: Bulk delete roles
      description: 'The role management APIs are generally the preferred way to manage roles, rather than using file-based role management.

        The bulk delete roles API cannot delete roles that are defined in roles files.


        ## Required authorization


        * Cluster privileges: `manage_security`

        '
      operationId: security-bulk-delete-role
      parameters:
      - in: query
        name: refresh
        description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Refresh'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                names:
                  description: An array of role names to delete
                  type: array
                  items:
                    type: string
              required:
              - names
            examples:
              SecurityBulkDeleteRoleRequestExample1:
                summary: Bulk delete example 1
                description: 'Run DELETE /_security/role` to delete `my_admin_role` and `my_user_role` roles.

                  '
                value: "{\n  \"names\": [\"my_admin_role\", \"my_user_role\"]\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleted:
                    description: Array of deleted roles
                    type: array
                    items:
                      type: string
                  not_found:
                    description: Array of roles that could not be found
                    type: array
                    items:
                      type: string
                  errors:
                    description: Present if any deletes resulted in errors
                    allOf:
                    - $ref: '#/components/schemas/security._types.BulkError'
              examples:
                SecurityBulkDeleteRoleResponseExample1:
                  summary: A successful response
                  description: A successful response from `DELETE /_security/role`.
                  value: "{\n  \"deleted\": [\n      \"my_admin_role\",\n      \"my_user_role\"\n  ]\n}"
                SecurityBulkDeleteRoleResponseExample2:
                  summary: A response with not_found roles
                  description: 'A partially successful response from `DELETE /_security/role`. If a role cannot be found, it appears in the `not_found` list in the response.

                    '
                  value: "{\n  \"deleted\": [\n      \"my_admin_role\"\n  ],\n  \"not_found\": [\n      \"not_an_existing_role\"\n  ]\n}"
                SecurityBulkDeleteRoleResponseExample3:
                  summary: A response with errors
                  description: 'A partially successful response from `DELETE /_security/role`. If part of a request fails or is invalid, the response includes `errors`.

                    '
                  value: "{\n  \"deleted\": [\n      \"my_admin_role\"\n  ],\n  \"errors\": {\n      \"count\": 1,\n      \"details\": {\n          \"superuser\": {\n              \"type\": \"illegal_argument_exception\",\n              \"reason\": \"role [superuser] is reserved and cannot be deleted\"\n          }\n      }\n  }\n}"
      x-state: Generally available; Added in 8.15.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_security/api_key/_bulk_update:
    post:
      tags:
      - security
      summary: Bulk update API keys
      description: 'Update the attributes for multiple API keys.


        IMPORTANT: It is not possible to use an API key as the authentication credential for this API. To update API keys, the owner user''s credentials are required.


        This API is similar to the update API key API but enables you to apply the same update to multiple API keys in one API call. This operation can greatly improve performance over making individual updates.


        It is not possible to update expired or invalidated API keys.


        This API supports updates to API key access scope, metadata and expiration.

        The access scope of each API key is derived from the `role_descriptors` you specify in the request and a snapshot of the owner user''s permissions at the time of the request.

        The snapshot of the owner''s permissions is updated automatically on every call.


        IMPORTANT: If you don''t specify `role_descriptors` in the request, a call to this API might still change an API key''s access scope. This change can occur if the owner user''s permissions have changed since the API key was created or last modified.


        A successful request returns a JSON structure that contains the IDs of all updated API keys, the IDs of API keys that already had the requested changes and did not require an update, and error details for any failed update.


        ## Required authorization


        * Cluster privileges: `manage_own_api_key`

        '
      operationId: security-bulk-update-api-keys
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                expiration:
                  description: 'Expiration time for the API keys.

                    By default, API keys never expire.

                    This property can be omitted to leave the value unchanged.'
                  allOf:
                  - $ref: '#/components/schemas/_types.Duration'
                ids:
                  description: The API key identifiers.
                  oneOf:
                  - type: string
                  - type: array
                    items:
                      type: string
                metadata:
                  description: 'Arbitrary nested metadata to associate with the API keys.

                    Within the `metadata` object, top-level keys beginning with an underscore (`_`) are reserved for system usage.

                    Any information specified with this parameter fully replaces metadata previously associated with the API key.'
                  allOf:
                  - $ref: '#/components/schemas/_types.Metadata'
                role_descriptors:
                  description: 'The role descriptors to assign to the API keys.

                    An API key''s effective permissions are an intersection of its assigned privileges and the point-in-time snapshot of permissions of the owner user.

                    You can assign new privileges by specifying them in this parameter.

                    To remove assigned privileges, supply the `role_descriptors` parameter as an empty object `{}`.

                    If an API key has no assigned privileges, it inherits the owner user''s full permissions.

                    The snapshot of the owner''s permissions is always updated, whether you supply the `role_descriptors` parameter.

                    The structure of a role descriptor is the same as the request for the create API keys API.'
                  type: object
                  additionalProperties:
                    $ref: '#/components/schemas/security._types.RoleDescriptor'
              required:
              - ids
            examples:
              SecurityBulkUpdateApiKeysRequestExample1:
                description: Assign new role descriptors and metadata and update the expiration time for two API keys.
                value: "{\n  \"ids\": [\n    \"VuaCfGcBCdbkQm-e5aOx\",\n    \"H3_AhoIBA9hmeQJdg7ij\"\n  ],\n  \"role_descriptors\": {\n    \"role-a\": {\n      \"indices\": [\n        {\n          \"names\": [\n            \"*\"\n          ],\n          \"privileges\": [\n            \"write\"\n          ]\n        }\n      ]\n    }\n  },\n  \"metadata\": {\n    \"environment\": {\n      \"level\": 2,\n      \"trusted\": true,\n      \"tags\": [\n        \"production\"\n      ]\n    }\n  },\n  \"expiration\": \"30d\"\n}"
              SecurityBulkUpdateApiKeysRequestExample2:
                description: Remove the previously assigned permissions for two API keys, making them inherit the owner user's full permissions.
                value: "{\n  \"ids\": [\n    \"VuaCfGcBCdbkQm-e5aOx\",\n    \"H3_AhoIBA9hmeQJdg7ij\"\n  ],\n  \"role_descriptors\": {}\n}"
        required: true
      responses:
        '200':
          description

# --- truncated at 32 KB (905 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-api-openapi.yml