IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elasticsearch Guide [7.13] ›REST APIs ›Security APIs
« Clear service account token caches API Create or update application privileges API »

Create API key APIedit

Creates an API key for access without requiring basic authentication.

Requestedit

POST /_security/api_key

PUT /_security/api_key

Prerequisitesedit

  • To use this API, you must have at least the manage_own_api_key cluster privilege.

If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error. See the note under role_descriptors.

Descriptionedit

The API keys are created by the Elasticsearch API key service, which is automatically enabled when you configure TLS on the HTTP interface. Alternatively, you can explicitly enable the xpack.security.authc.api_key.enabled setting. When you are running in production mode, a bootstrap check prevents you from enabling the API key service unless you also enable TLS on the HTTP interface.

A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

By default, API keys never expire. You can specify expiration information when you create the API keys.

See API key service settings for configuration settings related to API key service.

Request bodyedit

The following parameters can be specified in the body of a POST or PUT request:

name
(Required, string) Specifies the name for this API key.
role_descriptors

(Optional, array-of-role-descriptor) An array of role descriptors for this API key. This parameter is optional. When it is not specified or is an empty array, then the API key will have a point in time snapshot of permissions of the authenticated user. If you supply role descriptors then the resultant permissions would be an intersection of API keys permissions and authenticated user’s permissions thereby limiting the access scope for API keys. The structure of role descriptor is the same as the request for create role API. For more details, see create or update roles API.

Due to the way in which this permission intersection is calculated, it is not possible to create an API key that is a child of another API key, unless the derived key is created without any privileges. In this case, you must explicitly specify a role descriptor with no privileges. The derived API key can be used for authentication; it will not have authority to call Elasticsearch APIs.

expiration
(Optional, string) Expiration time for the API key. By default, API keys never expire.
metadata
(Optional, object) Arbitrary metadata that you want to associate with the API key. It supports nested data structure. Within the metadata object, keys beginning with _ are reserved for system usage.

Examplesedit

The following example creates an API key:

POST /_security/api_key
{
  "name": "my-api-key",
  "expiration": "1d",   
  "role_descriptors": { 
    "role-a": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-a*"],
          "privileges": ["read"]
        }
      ]
    },
    "role-b": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-b*"],
          "privileges": ["all"]
        }
      ]
    }
  },
  "metadata": {
    "application": "my-application",
    "environment": {
       "level": 1,
       "trusted": true,
       "tags": ["dev", "staging"]
    }
  }
}

Optional expiration for the API key being generated. If expiration is not provided then the API keys do not expire.

Optional role descriptors for this API key. If not provided, permissions of the authenticated user are applied.

A successful call returns a JSON structure that provides API key information.

{
  "id":"VuaCfGcBCdbkQm-e5aOx",       
  "name":"my-api-key",
  "expiration":1544068612110,        
  "api_key":"ui2lp2axTNmsyakw9tvNnw" 
}

Unique id for this API key

Optional expiration in milliseconds for this API key

Generated API key

To use the generated API key, send a request with an Authorization header that contains an ApiKey prefix followed by the API key credentials. The credentials are a Base64-encoded string in UTF-8 format that you create by combining the id and api_key with a colon (:). For example:

curl -H "Authorization: ApiKey <credentials>" \
http://localhost:9200/_cluster/health\?pretty

If your node has xpack.security.http.ssl.enabled set to true, then you must specify https when creating your API key

Use UTF-8 encoding

When converting the concatenated String of id and api_key into bytes, the format must be UTF-8. Authentication will fail if you use UTF-16 or UTF-32 encoding.

If you’re concatenating id and api_key and then getting the bytes of that String from the command line (like in this example), the echo command defaults to ASCII formatting, which is equivalent to UTF-8 encoding.

However, some other tools require an explicit encoding when converting a String into bytes. For example, in Java, you might use something like the following code, which assumes that result is the response from the create API key API. This conversion ensures that the bytes of the concatenated string is in UTF-8 format:

var bytes = (result.id + ":" + result.api_key).getBytes(StandardCharsets.UTF_8);
var header = "ApiKey " + Base64.getEncoder().encodeToString(bytes);

On a Unix-like system, the following command combines the id and api_key from the previous response. The concatenation of these parameters should be in UTF-8 format:

echo -n "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw" | base64

Use -n so that the echo command doesn’t print the trailing newline character

The command outputs a Base64-encoded String:

VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==

Use this String in a request to authenticate with your cluster:

curl -H "Authorization: ApiKey VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==" \
http://localhost:9200/_cluster/health\?pretty
« Clear service account token caches API Create or update application privileges API »