Elastic Docs ›Elasticsearch Service Documentation ›RESTful API
« Principles OpenAPI specification »

Authenticationedit

Elasticsearch Service supports and recommends key-based authentication for the API. An API key allows you to perform most of the operations available in the UI console through API calls. You can create and manage deployments, configure remote clusters, set up traffic filters, manage extensions, and much more.

Only Organization owners can create API keys for every user role. Like users, API keys can be assigned roles to control their access to organizational resources, such as deployments. You can have multiple API keys for different purposes, and you can revoke them when you no longer need them.

To create an API key:

  1. Log in to the Elasticsearch Service Console.
  2. Go to your avatar in the upper right corner and choose Organization.

  3. On the API keys tab of the Organization page, click Create API Key.

    This key provides access to the API that enables you to manage your deployments. It does not provide access to Elasticsearch. To access Elasticsearch with an API key, create a key in Kibana or using the Elasticsearch API.

  4. From the Create API Key page, you can configure your new key by adding a name, set expiration, or assign roles.

    By default, the API key will expire three months after its creation date, but you can set the expiration to Never. When an API key is nearing expiration, Elastic sends an email to the creator of the API key and each of the operational contacts. When you use an API key to authenticate, the API response header X-Elastic-Api-Key-Expiration indicates the key’s expiration date. You can log this value to detect API keys that are nearing expiration.

  5. Click Create API key, copy the generated API key, and store it in a safe place. You can also download the key as a CSV file.

The API key needs to be supplied in the Authorization header of a request, in the following format:

Authorization: ApiKey $EC_API_KEY

To revoke an API key:

  1. Log in to the Elasticsearch Service Console.

  2. Go to your avatar in the upper right corner and choose Organization.

    The keys currently associated with your organization are listed under the API keys tab of the Organization page.

  3. Find the key you want to revoke, and click the trash icon under Actions.
« Principles OpenAPI specification »