Get service accounts | Elasticsearch API documentation

Get service accounts Generally available; Added in 7.13.0

GET /_security/service/{namespace}/{service}

All methods and paths for this operation:

GET /_security/service

GET /_security/service/{namespace}

GET /_security/service/{namespace}/{service}

Get a list of service accounts that match the provided path parameters. Built-in service accounts ship with Elasticsearch in the elastic namespace; user-managed service accounts are created with the put user-managed service account API.

NOTE: When type is omitted, a request without a namespace reports built-in accounts only, which preserves the response of a whole-cluster listing. A request scoped to a namespace reports both kinds, so an account you created is found without naming its kind.

Required authorization

Cluster privileges: manage_service_account

More about service accounts

Path parameters

namespace string Required

The name of the namespace. Omit this parameter to retrieve information about all service accounts. If you omit this parameter, you must also omit the service parameter.
service string Required

The service name. Omit this parameter to retrieve information about all service accounts that belong to the specified namespace.

Query parameters

type string | array[string]
A comma-separated list of the kinds of service account to return. If it is omitted, it defaults to built_in when no namespace is given and to built_in,user_managed otherwise.

Supported values include:
- built_in: An account that ships with Elasticsearch, in the reserved elastic namespace.
- user_managed: An account created with the put user-managed service account API.
Values are built_in or user_managed.

Responses

200 application/json

GET /_security/service/{namespace}/{service}

GET /_security/service/elastic/fleet-server

resp = client.security.get_service_accounts(
    namespace="elastic",
    service="fleet-server",
)

const response = await client.security.getServiceAccounts({
  namespace: "elastic",
  service: "fleet-server",
});

response = client.security.get_service_accounts(
  namespace: "elastic",
  service: "fleet-server"
)

$resp = $client->security()->getServiceAccounts([
    "namespace" => "elastic",
    "service" => "fleet-server",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server"

var response = await client.Security
    .GetServiceAccountsAsync(d1 => d1
        .Namespace("elastic")
        .Service("fleet-server")
    );

client.security().getServiceAccounts(g -> g
    .namespace("elastic")
    .service("fleet-server")
);

Response examples (200)

A successful response from `GET /_security/service/elastic/fleet-server`. The response contains information about the `elastic/fleet-server` service account.

{
  "elastic/fleet-server": {
    "type": "built_in",
    "role_descriptor": {
      "cluster": [
        "monitor",
        "manage_own_api_key",
        "read_fleet_secrets"
      ],
      "indices": [
        {
          "names": [
            "logs-*",
            "metrics-*",
            "traces-*",
            ".logs-endpoint.diagnostic.collection-*",
            ".logs-endpoint.action.responses-*",
            ".logs-endpoint.heartbeat-*"
          ],
          "privileges": [
            "write",
            "create_index",
            "auto_configure"
          ],
          "allow_restricted_indices": false
        },
        {
          "names": [
            "profiling-*"
          ],
          "privileges": [
            "read",
            "write"
          ],
          "allow_restricted_indices": false
        },
        {
          "names": [
            "traces-apm.sampled-*"
          ],
          "privileges": [
            "read",
            "monitor",
            "maintenance"
          ],
          "allow_restricted_indices": false
        },
        {
          "names": [
            ".fleet-secrets*"
          ],
          "privileges": [
            "read"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-actions*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-agents*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-artifacts*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-enrollment-api-keys*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-policies*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-policies-leader*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-servers*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            ".fleet-fileds*"
          ],
          "privileges": [
            "read",
            "write",
            "monitor",
            "create_index",
            "auto_configure",
            "maintenance"
          ],
          "allow_restricted_indices": true
        },
        {
          "names": [
            "synthetics-*"
          ],
          "privileges": [
            "read",
            "write",
            "create_index",
            "auto_configure"
          ],
          "allow_restricted_indices": false
        }
      ],
      "applications": [
        {
          "application": "kibana-*",
          "privileges": [
            "reserved_fleet-setup"
          ],
          "resources": [
            "*"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    }
  }
}

A successful response from `GET /_security/service/my-namespace?type=user_managed`. The response contains the user-managed service accounts in the `my-namespace` namespace.

{
  "my-namespace/my-service": {
    "type": "user_managed",
    "roles": [
      "my_role"
    ],
    "enabled": true
  }
}