Bulk update API keys | Elasticsearch API documentation (original) (raw)

Dismiss highlight Show more

application/json

Body Required

• Expiration time for the API keys. By default, API keys never expire. This property can be omitted to leave the value unchanged.

• ids string | array[string] Required

The API key identifiers.

• Arbitrary nested metadata to associate with the API keys. Within the metadata object, top-level keys beginning with an underscore (_) are reserved for system usage. Any information specified with this parameter fully replaces metadata previously associated with the API key.
  Hide metadata attribute Show metadata attribute object
  • *
    object Additional properties
• The role descriptors to assign to the API keys. An API key's effective permissions are an intersection of its assigned privileges and the point-in-time snapshot of permissions of the owner user. You can assign new privileges by specifying them in this parameter. To remove assigned privileges, supply the role_descriptors parameter as an empty object {}. If an API key has no assigned privileges, it inherits the owner user's full permissions. The snapshot of the owner's permissions is always updated, whether you supply the role_descriptors parameter. The structure of a role descriptor is the same as the request for the create API keys API.
  Hide role_descriptors attribute Show role_descriptors attribute object
  • *
    object Additional properties
    Hide * attributes Show * attributes object
    * A list of cluster privileges. These privileges define the cluster level actions that API keys are able to execute.
    * A list of indices permissions entries.
    Hide indices attributes Show indices attributes object
    * The document fields that the owners of the role have read access to.
    * #### names string | array[string] Required
    A list of indices (or index name patterns) to which the permissions in this entry apply.
    * privileges
    array[string] Required
    The index level privileges that owners of the role have on the specified indices.
    * #### query string | object
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    * allow_restricted_indices
    boolean Generally available
    Set to true if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the names list, Elasticsearch checks privileges against these indices regardless of the value set for allow_restricted_indices.
    * remote_indices
    array[object] Generally available; Added in 8.14.0
    A list of indices permissions for remote clusters.
    The subset of index level privileges that can be defined for remote clusters.
    Hide remote_indices attributes Show remote_indices attributes object
    * clusters
    string | array[string] Required
    A list of cluster aliases to which the permissions in this entry apply.
    * The document fields that the owners of the role have read access to.
    * #### names string | array[string] Required
    A list of indices (or index name patterns) to which the permissions in this entry apply.
    * privileges
    array[string] Required
    The index level privileges that owners of the role have on the specified indices.
    * #### query string | object
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role.
    * allow_restricted_indices
    boolean Generally available
    Set to true if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the names list, Elasticsearch checks privileges against these indices regardless of the value set for allow_restricted_indices.
    * remote_cluster
    array[object] Generally available; Added in 8.15.0
    A list of cluster permissions for remote clusters. NOTE: This is limited a subset of the cluster permissions.
    The subset of cluster level privileges that can be defined for remote clusters.
    Hide remote_cluster attributes Show remote_cluster attributes object
    * clusters
    string | array[string] Required
    A list of cluster aliases to which the permissions in this entry apply.
    * privileges
    array[string] Required
    The cluster level privileges that owners of the role have on the remote cluster.
    Values are monitor_enrich or monitor_stats.
    * #### global array[object] | object
    An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges.
    Hide attribute Show attribute object
    * application
    object Required
    * applications
    array[object]
    A list of application privilege entries
    Hide applications attributes Show applications attributes object
    * application
    string Required
    The name of the application to which this entry applies.
    * privileges
    array[string] Required
    A list of strings, where each element is the name of an application privilege or action.
    * resources
    array[string] Required
    A list resources to which the privileges are applied.
    * Optional meta-data. Within the metadata object, keys that begin with _ are reserved for system usage.
    Hide metadata attribute Show metadata attribute object
    * *
    object Additional properties
    * A list of users that the API keys can impersonate. NOTE: In Elastic Cloud Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty run_as field, but a non-empty list will be rejected.
    * Optional description of the role descriptor
    * Restriction for when the role descriptor is allowed to be effective.
    Hide restriction attribute Show restriction attribute object
    * workflows
    array[string] Required
    A list of workflows to which the API key is restricted. NOTE: In order to use a role restriction, an API key must be created with a single role descriptor.
    * transient_metadata
    object
    Hide transient_metadata attribute Show transient_metadata attribute object
    * *
    object Additional properties

Responses

• 200 application/json
  Hide response attributes Show response attributes object
  • Hide errors attributes Show errors attributes object
    * The number of errors
    * Details about the errors, keyed by role name
    Hide details attribute Show details attribute object
    * Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
    Hide * attributes Show * attributes object
    * The type of error
    * #### reason string | null
    A human-readable explanation of the error, in English.
    * The server stack trace. Present only if the error_trace=true parameter was sent with the request.
    * Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
    * Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
    Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
    * Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
    Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
  • noops
    array[string] Required
  • updated
    array[string] Required