Has privileges API

Has privileges API

New API reference

For the most up-to-date API details, refer to Security APIs.

Determines whether the logged in user has a specified list of privileges.

Request

GET /_security/user/_has_privileges

POST /_security/user/_has_privileges

Prerequisites

Description

For a list of the privileges that you can specify in this API, see Security privileges.

A successful call returns a JSON structure that shows whether each specified privilege is assigned to the user.

Request body

cluster

(list) A list of the cluster privileges that you want to check.

index

  • names

    (list) A list of indices.

    allow_restricted_indices

    (Boolean) This needs to be set to true (default is false) if using wildcards or regexps for patterns that cover restricted indices. Implicitly, restricted indices do not match index patterns because restricted indices usually have limited privileges and including them in pattern tests would render most such tests false. If restricted indices are explicitly included in the names list, privileges will be checked against them regardless of the value of allow_restricted_indices.

    privileges

    (list) A list of the privileges that you want to check for the specified indices.

application

  • application

    (string) The name of the application.

    privileges

    (list) A list of the privileges that you want to check for the specified resources. May be either application privilege names, or the names of actions that are granted by those privileges

    resources

    (list) A list of resource names against which the privileges should be checked

Examples

The following example checks whether the current user has a specific set of cluster, index, and application privileges:

  1. resp = client.security.has_privileges(
  2.     cluster=[
  3.         "monitor",
  4.         "manage"
  5.     ],
  6.     index=[
  7.         {
  8.             "names": [
  9.                 "suppliers",
  10.                 "products"
  11.             ],
  12.             "privileges": [
  13.                 "read"
  14.             ]
  15.         },
  16.         {
  17.             "names": [
  18.                 "inventory"
  19.             ],
  20.             "privileges": [
  21.                 "read",
  22.                 "write"
  23.             ]
  24.         }
  25.     ],
  26.     application=[
  27.         {
  28.             "application": "inventory_manager",
  29.             "privileges": [
  30.                 "read",
  31.                 "data:write/inventory"
  32.             ],
  33.             "resources": [
  34.                 "product/1852563"
  35.             ]
  36.         }
  37.     ],
  38. )
  39. print(resp)
  1. const response = await client.security.hasPrivileges({
  2.   cluster: ["monitor", "manage"],
  3.   index: [
  4.     {
  5.       names: ["suppliers", "products"],
  6.       privileges: ["read"],
  7.     },
  8.     {
  9.       names: ["inventory"],
  10.       privileges: ["read", "write"],
  11.     },
  12.   ],
  13.   application: [
  14.     {
  15.       application: "inventory_manager",
  16.       privileges: ["read", "data:write/inventory"],
  17.       resources: ["product/1852563"],
  18.     },
  19.   ],
  20. });
  21. console.log(response);
  1. GET /_security/user/_has_privileges
  2. {
  3.   "cluster": [ "monitor", "manage" ],
  4.   "index" : [
  5.     {
  6.       "names": [ "suppliers", "products" ],
  7.       "privileges": [ "read" ]
  8.     },
  9.     {
  10.       "names": [ "inventory" ],
  11.       "privileges" : [ "read", "write" ]
  12.     }
  13.   ],
  14.   "application": [
  15.     {
  16.       "application": "inventory_manager",
  17.       "privileges" : [ "read", "data:write/inventory" ],
  18.       "resources" : [ "product/1852563" ]
  19.     }
  20.   ]
  21. }

The following example output indicates which privileges the “rdeniro” user has:

  1. {
  2.   "username": "rdeniro",
  3.   "has_all_requested" : false,
  4.   "cluster" : {
  5.     "monitor" : true,
  6.     "manage" : false
  7.   },
  8.   "index" : {
  9.     "suppliers" : {
  10.       "read" : true
  11.     },
  12.     "products" : {
  13.       "read" : true
  14.     },
  15.     "inventory" : {
  16.       "read" : true,
  17.       "write" : false
  18.     }
  19.   },
  20.   "application" : {
  21.     "inventory_manager" : {
  22.       "product/1852563" : {
  23.         "read": false,
  24.         "data:write/inventory": false
  25.       }
  26.     }
  27.   }
  28. }