Creates an API key for access without requiring basic authentication.
To use this API, you must have at least the
If the credential that is used to authenticate this request is
an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.
See the note under
The API keys are created by the Elasticsearch API key service, which is automatically enabled
when you configure TLS on the HTTP interface. See Encrypting HTTP client communications. Alternatively,
you can explicitly enable the
xpack.security.authc.api_key.enabled setting. When
you are running in production mode, a bootstrap check prevents you from enabling
the API key service unless you also enable TLS on the HTTP interface.
A successful create API key API call returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.
By default, API keys never expire. You can specify expiration information when you create the API keys.
See API key service settings for configuration settings related to API key service.
The following parameters can be specified in the body of a POST or PUT request:
- (Required, string) Specifies the name for this API key.
(Optional, array-of-role-descriptor) An array of role descriptors for this API key. This parameter is optional. When it is not specified or is an empty array, then the API key will have a point in time snapshot of permissions of the authenticated user. If you supply role descriptors then the resultant permissions would be an intersection of API keys permissions and authenticated user’s permissions thereby limiting the access scope for API keys. The structure of role descriptor is the same as the request for create role API. For more details, see create or update roles API.
Due to the way in which this permission intersection is calculated, it is not possible to create an API key that is a child of another API key, unless the derived key is created without any privileges. In this case, you must explicitly specify a role descriptor with no privileges. The derived API key can be used for authentication; it will not have authority to call Elasticsearch APIs.
- (Optional, string) Expiration time for the API key. By default, API keys never expire.
The following example creates an API key:
optional expiration for the API key being generated. If expiration is not provided then the API keys do not expire.
optional role descriptors for this API key, if not provided then permissions of authenticated user are applied.
A successful call returns a JSON structure that provides API key information.
The API key returned by this API can then be used by sending a request with an
Authorization header with a value having the prefix
by the credentials, where credentials are the base64 encoding of
api_key joined by a colon.
If your node has
xpack.security.http.ssl.enabled set to
true, then you must specify
https when creating your API key.
curl -H "Authorization: ApiKey VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==" http://localhost:9200/_cluster/health
One way to create the credentials from CLI on an Unix-like system is as the follows:
# Please note the use of "-n" to instruct echo to not print the trailing newline character. # It should return VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw== echo -n "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw" | base64