Clone an API key Technical preview; Added in 9.4.0

PUT /_security/api_key/clone
Api key auth Basic auth Bearer auth

All methods and paths for this operation:

POST /_security/api_key/clone

PUT /_security/api_key/clone

Create a copy of an existing API key with a new ID. The cloned key inherits the role descriptors of the source key. This is intended for applications (such as Kibana) that need to create API keys on behalf of a user using an existing API key credential, since derived API keys (API keys created by API keys) are not otherwise supported.

Required authorization

  • Cluster privileges: manage_own_api_key

Query parameters

  • refresh string

    If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.

    Values are true, false, or wait_for.

application/json

Body Required

  • api_key string Required

    The credentials of the API key to clone. This is the secret value returned when the key was originally created.

  • name string

    A name for the cloned API key. If not provided, the name of the source key is used.

  • expiration string

    The expiration time for the cloned API key. By default, API keys never expire. Set to null to explicitly create a key with no expiration.

    External documentation
  • metadata object

    Arbitrary metadata to associate with the cloned API key. It supports nested data structure. Within the metadata object, keys beginning with _ are reserved for system usage.

    Hide metadata attribute Show metadata attribute object
    • * object Additional properties

Responses

  • 200 application/json
    Hide response attributes Show response attributes object
    • api_key string Required

      The generated API key value for the cloned key.

    • expiration number

      Expiration in milliseconds for the API key.

    • id string Required

      The unique ID of the cloned API key.

    • name string Required

      The name of the cloned API key.

    • encoded string Required

      API key credentials which is the base64-encoding of the UTF-8 representation of id and api_key joined by a colon (:).
PUT /_security/api_key/clone 
curl \
 --request PUT 'http://api.example.com/_security/api_key/clone' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"api_key":"string","name":"string","expiration":"string","metadata":{"additionalProperty1":{},"additionalProperty2":{}}}'