[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elasticsearch-authn":3,"mdc-6w44dm-key":34,"related-repo-elastic-elasticsearch-authn":3429,"related-org-elastic-elasticsearch-authn":3516},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Authentication","authentication",{"name":21,"slug":22,"type":15},"Elasticsearch","elasticsearch",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:47:41.474547",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Felasticsearch\u002Fskills\u002Felasticsearch-authn","---\nname: elasticsearch-authn\ndescription: >\n  Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos,\n  JWT, or certificate realms. Use when connecting with credentials, choosing a realm,\n  or managing API keys. Assumes the target realms are already configured.\ncompatibility: >\n  Requires curl or an HTTP client and network access to the target Elasticsearch cluster\n  endpoint. Environment variables: ELASTICSEARCH_URL (required), plus one of ELASTICSEARCH_API_KEY,\n  ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD, or realm-specific credentials depending\n  on the authentication method.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Elasticsearch Authentication\n\nAuthenticate to an Elasticsearch cluster using any supported authentication realm that is already configured. This skill\ncovers all built-in realms, credential verification, and the full API key lifecycle.\n\nFor roles, users, role assignment, and role mappings, see the **elasticsearch-authz** skill.\n\nFor detailed API endpoints, see [references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n> **Deployment note:** Not all realms are available on every deployment type. See\n> [Deployment Compatibility](#deployment-compatibility) for self-managed vs. ECH vs. Serverless details.\n\n## Critical principles\n\n- **Never ask for credentials in chat.** Do not ask the user to paste passwords, API keys, tokens, or any secret into\n  the conversation. Secrets must not appear in conversation history.\n- **Always use environment variables.** All code examples in this skill reference environment variables (e.g.\n  `ELASTICSEARCH_PASSWORD`, `ELASTICSEARCH_API_KEY`). When a required variable is missing, instruct the user to set it\n  in a `.env` file in the project root — never prompt for the value directly.\n- **Prefer `.env` over terminal exports.** Agents may run commands in a sandboxed shell session that does not inherit\n  the user's terminal environment. A `.env` file in the working directory is reliable across all execution contexts.\n  Only suggest `export` as a fallback when the user explicitly prefers it.\n\n## Jobs to Be Done\n\n- Authenticate to a cluster using username and password (native realm)\n- Connect using an API key (bearer token)\n- Verify who is currently authenticated (`_authenticate`)\n- Choose the right authentication realm for a deployment\n- Create an API key with scoped privileges for automation or service access\n- Rotate or invalidate an existing API key\n- Set up service account tokens for Elastic stack components\n- Authenticate with PKI \u002F mutual TLS certificate-based authentication after PKI\u002FTLS setup\n- Authenticate with configured external identity providers (SAML, OIDC, LDAP, AD, Kerberos)\n- Grant API keys on behalf of other users\n\n## Prerequisites\n\n| Item                  | Description                                                                                                                 |\n| --------------------- | --------------------------------------------------------------------------------------------------------------------------- |\n| **Elasticsearch URL** | Cluster endpoint (e.g. `https:\u002F\u002Flocalhost:9200` or a Cloud deployment URL)                                                  |\n| **Credentials**       | Depends on the realm — see the methods below                                                                                |\n| **Realms configured** | Authentication realms and their identity backends must already be configured (realm chain, IdP, LDAP\u002FAD, Kerberos, PKI\u002FTLS) |\n\nIf any required value is missing, instruct the user to add it to a `.env` file in the project root. Terminal exports may\nnot be visible to agents running in a separate shell session — the `.env` file is the reliable default. **Never ask the\nuser to paste credentials into the chat** — secrets must not appear in conversation history.\n\n## Authentication Realms\n\nElasticsearch evaluates realms in a configured order (the **realm chain**). The first realm that can authenticate the\nrequest wins. Internal realms are managed by Elasticsearch; external realms delegate to enterprise identity systems.\n\n### Internal realms\n\n#### Native (username and password)\n\nUsers stored in a dedicated Elasticsearch index. Simplest method for interactive use. Managed via Kibana or the user\nmanagement APIs (see the elasticsearch-authz skill).\n\n```bash\ncurl -u \"${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n#### File\n\nUsers defined in flat files on each cluster node (`elasticsearch-users` CLI). Always active regardless of license state,\nmaking it the fallback for disaster recovery when paid realms are disabled. Only available on self-managed deployments.\n\n```bash\ncurl -u \"${FILE_USER}:${FILE_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n### External realms\n\n#### LDAP\n\nAuthenticates against an external LDAP directory using username and password. Self-managed only — not available on ECH\nor Serverless. Typically combined with role mappings to translate LDAP groups to Elasticsearch roles.\n\n```bash\ncurl -u \"${LDAP_USER}:${LDAP_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nThe request is identical to native — Elasticsearch routes it to the LDAP realm via the realm chain.\n\n#### Active Directory\n\nAuthenticates against an Active Directory domain. Self-managed only — not available on ECH or Serverless. Similar to\nLDAP but uses AD-specific defaults (user principal name, `sAMAccountName`). Typically combined with role mappings for AD\ngroup-to-role translation.\n\n```bash\ncurl -u \"${AD_USER}:${AD_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n#### PKI (TLS client certificates)\n\nAuthenticates using X.509 client certificates presented during the TLS handshake. Requires a PKI realm and TLS on the\nHTTP layer. On ECH, PKI support is limited — check deployment settings. Not available on Serverless. Best for\nservice-to-service communication in mutual TLS environments.\n\n```bash\ncurl --cert \"${CLIENT_CERT}\" --key \"${CLIENT_KEY}\" --cacert \"${CA_CERT}\" \\\n  \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n#### SAML\n\nEnables SAML 2.0 Web Browser SSO, primarily for Kibana authentication. On self-managed, configure in\n`elasticsearch.yml`. On ECH, configure through the Cloud deployment settings UI. On Serverless, SAML is handled at the\norganization level and not configurable per project. Not usable by standard REST clients — the browser-based redirect\nflow is handled by Kibana. Configure another realm (e.g. native or API keys) alongside SAML for programmatic API access.\n\n#### OIDC (OpenID Connect)\n\nEnables OpenID Connect SSO, primarily for Kibana authentication. On self-managed, configure in `elasticsearch.yml`. On\nECH, configure through the Cloud deployment settings UI. Not available on Serverless. Like SAML, it relies on browser\nredirects and is not suited for direct REST client use. For programmatic access alongside OIDC, use API keys or native\nusers.\n\nCustom applications can exchange OIDC tokens for Elasticsearch access tokens via `POST \u002F_security\u002Foidc\u002Fauthenticate`,\nbut this requires implementing the full OIDC redirect flow.\n\n#### JWT (JSON Web Tokens)\n\nAccepts JWTs issued by an external identity provider as bearer tokens. On self-managed, configure in\n`elasticsearch.yml`. On ECH, configure through the Cloud deployment settings UI. Not available on Serverless. Supports\ntwo token types:\n\n- **`id_token`** (default) — OpenID Connect ID tokens for user-on-behalf-of flows.\n- **`access_token`** — OAuth2 client credentials for application identity flows.\n\n```bash\ncurl -H \"Authorization: Bearer ${JWT_TOKEN}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nEach JWT realm handles one token type. Configure separate realms for `id_token` and `access_token` if both are needed.\n\n#### Kerberos\n\nAuthenticates using Kerberos tickets via the SPNEGO mechanism. Self-managed only — not available on ECH or Serverless.\nRequires a working KDC infrastructure, proper DNS, and time synchronization.\n\n```bash\nkinit \"${KERBEROS_PRINCIPAL}\"\ncurl --negotiate -u : \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nThe `--negotiate` flag enables SPNEGO. The `-u :` is required by curl but the username is ignored — the principal from\n`kinit` is used. Requires curl 7.49+ with GSS-API\u002FSPNEGO support.\n\n### API keys\n\nNot a realm, but a distinct authentication mechanism. Pass a Base64-encoded API key in the `Authorization` header.\nPreferred for programmatic and automated access.\n\n```bash\ncurl -H \"Authorization: ApiKey ${ELASTICSEARCH_API_KEY}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n`ELASTICSEARCH_API_KEY` is the `encoded` value (Base64 of `id:api_key`) returned when the key was created.\n\n### Verify authentication\n\nAlways verify credentials before proceeding:\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nCheck `username`, `roles`, and `authentication_realm.type` to confirm identity and method:\n\n| `authentication_realm.type` | Realm            |\n| --------------------------- | ---------------- |\n| `native`                    | Native           |\n| `file`                      | File             |\n| `ldap`                      | LDAP             |\n| `active_directory`          | Active Directory |\n| `pki`                       | PKI              |\n| `saml`                      | SAML             |\n| `oidc`                      | OpenID Connect   |\n| `jwt`                       | JWT              |\n| `kerberos`                  | Kerberos         |\n\nFor API keys, `authentication_type` is `\"api_key\"` (not a realm type).\n\n## Manage API Keys\n\n### Create an API key\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"'\"${KEY_NAME}\"'\",\n    \"expiration\": \"30d\",\n    \"role_descriptors\": {\n      \"'\"${ROLE_NAME}\"'\": {\n        \"cluster\": [],\n        \"indices\": [\n          {\n            \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n            \"privileges\": [\"read\"]\n          }\n        ]\n      }\n    }\n  }'\n```\n\nThe response contains `id`, `api_key`, and `encoded`. Store `encoded` securely — it cannot be retrieved again.\n\nOmit `role_descriptors` to inherit a snapshot of the authenticated user's current privileges.\n\n> **Limitation:** An API key **cannot** create another API key with privileges. The derived key is created with no\n> effective access. Use `POST \u002F_security\u002Fapi_key\u002Fgrant` with user credentials instead.\n\n### Get and invalidate API keys\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=${KEY_NAME}\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"'\"${KEY_NAME}\"'\"}'\n```\n\n## Examples\n\n### Create a scoped API key\n\n**Request:** \"Create an API key that can only read from `metrics-*`.\"\n\n```json\nPOST \u002F_security\u002Fapi_key\n{\n  \"name\": \"metrics-reader-key\",\n  \"expiration\": \"90d\",\n  \"role_descriptors\": {\n    \"metrics-reader\": {\n      \"indices\": [\n        {\n          \"names\": [\"metrics-*\"],\n          \"privileges\": [\"read\", \"view_index_metadata\"]\n        }\n      ]\n    }\n  }\n}\n```\n\n### Verify which realm authenticated the user\n\n```json\nGET \u002F_security\u002F_authenticate\n```\n\n```json\n{\n  \"username\": \"joe\",\n  \"authentication_realm\": { \"name\": \"ldap1\", \"type\": \"ldap\" },\n  \"authentication_type\": \"realm\"\n}\n```\n\n### Authenticate with a JWT bearer token\n\n```bash\ncurl -H \"Authorization: Bearer ${JWT_TOKEN}\" \"https:\u002F\u002Fmy-cluster:9200\u002F_security\u002F_authenticate\"\n```\n\nConfirm the response shows `authentication_realm.type` as `\"jwt\"`.\n\n## Guidelines\n\n### Choosing an authentication method\n\n| Method          | Best for                                    | Trade-offs                                      |\n| --------------- | ------------------------------------------- | ----------------------------------------------- |\n| Native user     | Interactive use, simple setups              | Password must be stored or prompted             |\n| File user       | Disaster recovery, bootstrap                | Must be configured on every node                |\n| API key         | Programmatic access, CI\u002FCD, scoped access   | Cannot be retrieved after creation              |\n| LDAP \u002F AD       | Enterprise directory integration            | Requires network access to directory server     |\n| PKI certificate | Service-to-service, mutual TLS environments | Requires PKI infrastructure and PKI realm       |\n| SAML            | Kibana SSO via enterprise IdP               | Browser-only; not for REST clients              |\n| OIDC            | Kibana SSO via OpenID Connect provider      | Browser-only; not for REST clients              |\n| JWT             | Token-based service and user authentication | Requires external token issuer and realm config |\n| Kerberos        | Windows\u002Fenterprise Kerberos environments    | Requires KDC, DNS, time sync infrastructure     |\n\nPrefer API keys for automated workflows — they support fine-grained scoping and independent expiration. For Kibana SSO,\nuse SAML or OIDC. For enterprise directory integration, use LDAP or AD with role mappings (see elasticsearch-authz).\n\n### Avoid superuser credentials\n\nNever use the built-in `elastic` superuser or any `superuser`-role account for day-to-day operations, automation, or\napplication access. Instead, create a dedicated user or API key with only the privileges the task requires. The\n`elastic` user should be reserved for initial cluster setup and emergency recovery only.\n\n### Security\n\n- An API key **cannot** create another API key with privileges. Use user credentials or `POST \u002F_security\u002Fapi_key\u002Fgrant`\n  for programmatic key creation.\n- Always set `expiration` on API keys. Avoid indefinite keys in production.\n- Scope API keys via `role_descriptors`. Never create unscoped keys for automated systems.\n- Never receive, echo, or log passwords, API keys, tokens, or any credentials in the chat. Instruct the user to manage\n  secrets in their terminal, environment variables, or files directly.\n- Never store secrets in code, scripts, or version control. Load from environment variables.\n- Use `GET \u002F_security\u002F_authenticate` to verify credentials before running management operations.\n- When generating passwords for native users, use at least 16 characters mixing uppercase, lowercase, digits, and\n  symbols. Never use placeholder values like `changeme` or `password123`.\n- SAML and OIDC are for browser-based SSO only. Always configure a companion realm (native, file, or API keys) for REST\n  API access alongside them.\n\n## Deployment Compatibility\n\nNot all authentication realms are available on every deployment type. **Self-managed** clusters support all realms.\n**Elastic Cloud Hosted (ECH)** is managed by Elastic with no node-level access. **Serverless** is fully managed SaaS.\n\n| Realm            | Self-managed | ECH                     | Serverless         |\n| ---------------- | ------------ | ----------------------- | ------------------ |\n| Native           | Yes          | Yes                     | Not available      |\n| File             | Yes          | Not available           | Not available      |\n| LDAP             | Yes          | Not available           | Not available      |\n| Active Directory | Yes          | Not available           | Not available      |\n| PKI              | Yes          | Limited                 | Not available      |\n| SAML             | Yes          | Yes (deployment config) | Organization-level |\n| OIDC             | Yes          | Yes (deployment config) | Not available      |\n| JWT              | Yes          | Yes (deployment config) | Not available      |\n| Kerberos         | Yes          | Not available           | Not available      |\n| API keys         | Yes          | Yes                     | Yes                |\n\n**ECH notes:**\n\n- No node access, so the file realm and `elasticsearch-users` CLI are not available.\n- LDAP, Active Directory, and Kerberos cannot be configured on ECH.\n- SAML, OIDC, and JWT are configurable via the Cloud deployment settings UI.\n- The `elastic` superuser is available but should still be avoided for routine use.\n\n**Serverless notes:**\n\n- API keys are the primary authentication method.\n- Native users do not exist — users are managed at the Elastic Cloud organization level.\n- SAML SSO is configured at the organization level, not per project.\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires curl or an HTTP client and network access to the target Elasticsearch cluster endpoint. Environment variables: ELASTICSEARCH_URL (required), plus one of ELASTICSEARCH_API_KEY, ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD, or realm-specific credentials depending on the authentication method.\n",{"author":8,"version":38},"0.1.0",{"type":40,"children":41},"root",[42,51,57,70,83,105,112,194,200,261,267,351,377,383,395,402,409,414,502,508,521,589,595,601,606,674,679,685,698,766,772,777,875,881,894,900,912,925,931,943,974,1036,1055,1061,1066,1136,1164,1170,1183,1242,1268,1274,1279,1333,1361,1530,1551,1557,1563,1869,1902,1915,1943,1949,2132,2138,2144,2162,2489,2495,2509,2690,2696,2747,2766,2772,2778,2963,2968,2974,3001,3005,3098,3103,3129,3353,3361,3397,3405,3423],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"elasticsearch-authentication",[48],{"type":49,"value":50},"text","Elasticsearch Authentication",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55],{"type":49,"value":56},"Authenticate to an Elasticsearch cluster using any supported authentication realm that is already configured. This skill\ncovers all built-in realms, credential verification, and the full API key lifecycle.",{"type":43,"tag":52,"props":58,"children":59},{},[60,62,68],{"type":49,"value":61},"For roles, users, role assignment, and role mappings, see the ",{"type":43,"tag":63,"props":64,"children":65},"strong",{},[66],{"type":49,"value":67},"elasticsearch-authz",{"type":49,"value":69}," skill.",{"type":43,"tag":52,"props":71,"children":72},{},[73,75,81],{"type":49,"value":74},"For detailed API endpoints, see ",{"type":43,"tag":76,"props":77,"children":79},"a",{"href":78},"references\u002Fapi-reference.md",[80],{"type":49,"value":78},{"type":49,"value":82},".",{"type":43,"tag":84,"props":85,"children":86},"blockquote",{},[87],{"type":43,"tag":52,"props":88,"children":89},{},[90,95,97,103],{"type":43,"tag":63,"props":91,"children":92},{},[93],{"type":49,"value":94},"Deployment note:",{"type":49,"value":96}," Not all realms are available on every deployment type. See\n",{"type":43,"tag":76,"props":98,"children":100},{"href":99},"#deployment-compatibility",[101],{"type":49,"value":102},"Deployment Compatibility",{"type":49,"value":104}," for self-managed vs. ECH vs. Serverless details.",{"type":43,"tag":106,"props":107,"children":109},"h2",{"id":108},"critical-principles",[110],{"type":49,"value":111},"Critical principles",{"type":43,"tag":113,"props":114,"children":115},"ul",{},[116,127,162],{"type":43,"tag":117,"props":118,"children":119},"li",{},[120,125],{"type":43,"tag":63,"props":121,"children":122},{},[123],{"type":49,"value":124},"Never ask for credentials in chat.",{"type":49,"value":126}," Do not ask the user to paste passwords, API keys, tokens, or any secret into\nthe conversation. Secrets must not appear in conversation history.",{"type":43,"tag":117,"props":128,"children":129},{},[130,135,137,144,146,152,154,160],{"type":43,"tag":63,"props":131,"children":132},{},[133],{"type":49,"value":134},"Always use environment variables.",{"type":49,"value":136}," All code examples in this skill reference environment variables (e.g.\n",{"type":43,"tag":138,"props":139,"children":141},"code",{"className":140},[],[142],{"type":49,"value":143},"ELASTICSEARCH_PASSWORD",{"type":49,"value":145},", ",{"type":43,"tag":138,"props":147,"children":149},{"className":148},[],[150],{"type":49,"value":151},"ELASTICSEARCH_API_KEY",{"type":49,"value":153},"). When a required variable is missing, instruct the user to set it\nin a ",{"type":43,"tag":138,"props":155,"children":157},{"className":156},[],[158],{"type":49,"value":159},".env",{"type":49,"value":161}," file in the project root — never prompt for the value directly.",{"type":43,"tag":117,"props":163,"children":164},{},[165,177,179,184,186,192],{"type":43,"tag":63,"props":166,"children":167},{},[168,170,175],{"type":49,"value":169},"Prefer ",{"type":43,"tag":138,"props":171,"children":173},{"className":172},[],[174],{"type":49,"value":159},{"type":49,"value":176}," over terminal exports.",{"type":49,"value":178}," Agents may run commands in a sandboxed shell session that does not inherit\nthe user's terminal environment. A ",{"type":43,"tag":138,"props":180,"children":182},{"className":181},[],[183],{"type":49,"value":159},{"type":49,"value":185}," file in the working directory is reliable across all execution contexts.\nOnly suggest ",{"type":43,"tag":138,"props":187,"children":189},{"className":188},[],[190],{"type":49,"value":191},"export",{"type":49,"value":193}," as a fallback when the user explicitly prefers it.",{"type":43,"tag":106,"props":195,"children":197},{"id":196},"jobs-to-be-done",[198],{"type":49,"value":199},"Jobs to Be Done",{"type":43,"tag":113,"props":201,"children":202},{},[203,208,213,226,231,236,241,246,251,256],{"type":43,"tag":117,"props":204,"children":205},{},[206],{"type":49,"value":207},"Authenticate to a cluster using username and password (native realm)",{"type":43,"tag":117,"props":209,"children":210},{},[211],{"type":49,"value":212},"Connect using an API key (bearer token)",{"type":43,"tag":117,"props":214,"children":215},{},[216,218,224],{"type":49,"value":217},"Verify who is currently authenticated (",{"type":43,"tag":138,"props":219,"children":221},{"className":220},[],[222],{"type":49,"value":223},"_authenticate",{"type":49,"value":225},")",{"type":43,"tag":117,"props":227,"children":228},{},[229],{"type":49,"value":230},"Choose the right authentication realm for a deployment",{"type":43,"tag":117,"props":232,"children":233},{},[234],{"type":49,"value":235},"Create an API key with scoped privileges for automation or service access",{"type":43,"tag":117,"props":237,"children":238},{},[239],{"type":49,"value":240},"Rotate or invalidate an existing API key",{"type":43,"tag":117,"props":242,"children":243},{},[244],{"type":49,"value":245},"Set up service account tokens for Elastic stack components",{"type":43,"tag":117,"props":247,"children":248},{},[249],{"type":49,"value":250},"Authenticate with PKI \u002F mutual TLS certificate-based authentication after PKI\u002FTLS setup",{"type":43,"tag":117,"props":252,"children":253},{},[254],{"type":49,"value":255},"Authenticate with configured external identity providers (SAML, OIDC, LDAP, AD, Kerberos)",{"type":43,"tag":117,"props":257,"children":258},{},[259],{"type":49,"value":260},"Grant API keys on behalf of other users",{"type":43,"tag":106,"props":262,"children":264},{"id":263},"prerequisites",[265],{"type":49,"value":266},"Prerequisites",{"type":43,"tag":268,"props":269,"children":270},"table",{},[271,290],{"type":43,"tag":272,"props":273,"children":274},"thead",{},[275],{"type":43,"tag":276,"props":277,"children":278},"tr",{},[279,285],{"type":43,"tag":280,"props":281,"children":282},"th",{},[283],{"type":49,"value":284},"Item",{"type":43,"tag":280,"props":286,"children":287},{},[288],{"type":49,"value":289},"Description",{"type":43,"tag":291,"props":292,"children":293},"tbody",{},[294,319,335],{"type":43,"tag":276,"props":295,"children":296},{},[297,306],{"type":43,"tag":298,"props":299,"children":300},"td",{},[301],{"type":43,"tag":63,"props":302,"children":303},{},[304],{"type":49,"value":305},"Elasticsearch URL",{"type":43,"tag":298,"props":307,"children":308},{},[309,311,317],{"type":49,"value":310},"Cluster endpoint (e.g. ",{"type":43,"tag":138,"props":312,"children":314},{"className":313},[],[315],{"type":49,"value":316},"https:\u002F\u002Flocalhost:9200",{"type":49,"value":318}," or a Cloud deployment URL)",{"type":43,"tag":276,"props":320,"children":321},{},[322,330],{"type":43,"tag":298,"props":323,"children":324},{},[325],{"type":43,"tag":63,"props":326,"children":327},{},[328],{"type":49,"value":329},"Credentials",{"type":43,"tag":298,"props":331,"children":332},{},[333],{"type":49,"value":334},"Depends on the realm — see the methods below",{"type":43,"tag":276,"props":336,"children":337},{},[338,346],{"type":43,"tag":298,"props":339,"children":340},{},[341],{"type":43,"tag":63,"props":342,"children":343},{},[344],{"type":49,"value":345},"Realms configured",{"type":43,"tag":298,"props":347,"children":348},{},[349],{"type":49,"value":350},"Authentication realms and their identity backends must already be configured (realm chain, IdP, LDAP\u002FAD, Kerberos, PKI\u002FTLS)",{"type":43,"tag":52,"props":352,"children":353},{},[354,356,361,363,368,370,375],{"type":49,"value":355},"If any required value is missing, instruct the user to add it to a ",{"type":43,"tag":138,"props":357,"children":359},{"className":358},[],[360],{"type":49,"value":159},{"type":49,"value":362}," file in the project root. Terminal exports may\nnot be visible to agents running in a separate shell session — the ",{"type":43,"tag":138,"props":364,"children":366},{"className":365},[],[367],{"type":49,"value":159},{"type":49,"value":369}," file is the reliable default. ",{"type":43,"tag":63,"props":371,"children":372},{},[373],{"type":49,"value":374},"Never ask the\nuser to paste credentials into the chat",{"type":49,"value":376}," — secrets must not appear in conversation history.",{"type":43,"tag":106,"props":378,"children":380},{"id":379},"authentication-realms",[381],{"type":49,"value":382},"Authentication Realms",{"type":43,"tag":52,"props":384,"children":385},{},[386,388,393],{"type":49,"value":387},"Elasticsearch evaluates realms in a configured order (the ",{"type":43,"tag":63,"props":389,"children":390},{},[391],{"type":49,"value":392},"realm chain",{"type":49,"value":394},"). The first realm that can authenticate the\nrequest wins. Internal realms are managed by Elasticsearch; external realms delegate to enterprise identity systems.",{"type":43,"tag":396,"props":397,"children":399},"h3",{"id":398},"internal-realms",[400],{"type":49,"value":401},"Internal realms",{"type":43,"tag":403,"props":404,"children":406},"h4",{"id":405},"native-username-and-password",[407],{"type":49,"value":408},"Native (username and password)",{"type":43,"tag":52,"props":410,"children":411},{},[412],{"type":49,"value":413},"Users stored in a dedicated Elasticsearch index. Simplest method for interactive use. Managed via Kibana or the user\nmanagement APIs (see the elasticsearch-authz skill).",{"type":43,"tag":415,"props":416,"children":421},"pre",{"className":417,"code":418,"language":419,"meta":420,"style":420},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -u \"${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n","bash","",[422],{"type":43,"tag":138,"props":423,"children":424},{"__ignoreMap":420},[425],{"type":43,"tag":426,"props":427,"children":430},"span",{"class":428,"line":429},"line",1,[431,437,443,449,455,460,465,470,474,479,483,488,492,497],{"type":43,"tag":426,"props":432,"children":434},{"style":433},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[435],{"type":49,"value":436},"curl",{"type":43,"tag":426,"props":438,"children":440},{"style":439},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[441],{"type":49,"value":442}," -u",{"type":43,"tag":426,"props":444,"children":446},{"style":445},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[447],{"type":49,"value":448}," \"${",{"type":43,"tag":426,"props":450,"children":452},{"style":451},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[453],{"type":49,"value":454},"ELASTICSEARCH_USERNAME",{"type":43,"tag":426,"props":456,"children":457},{"style":445},[458],{"type":49,"value":459},"}",{"type":43,"tag":426,"props":461,"children":462},{"style":439},[463],{"type":49,"value":464},":",{"type":43,"tag":426,"props":466,"children":467},{"style":445},[468],{"type":49,"value":469},"${",{"type":43,"tag":426,"props":471,"children":472},{"style":451},[473],{"type":49,"value":143},{"type":43,"tag":426,"props":475,"children":476},{"style":445},[477],{"type":49,"value":478},"}\"",{"type":43,"tag":426,"props":480,"children":481},{"style":445},[482],{"type":49,"value":448},{"type":43,"tag":426,"props":484,"children":485},{"style":451},[486],{"type":49,"value":487},"ELASTICSEARCH_URL",{"type":43,"tag":426,"props":489,"children":490},{"style":445},[491],{"type":49,"value":459},{"type":43,"tag":426,"props":493,"children":494},{"style":439},[495],{"type":49,"value":496},"\u002F_security\u002F_authenticate",{"type":43,"tag":426,"props":498,"children":499},{"style":445},[500],{"type":49,"value":501},"\"\n",{"type":43,"tag":403,"props":503,"children":505},{"id":504},"file",[506],{"type":49,"value":507},"File",{"type":43,"tag":52,"props":509,"children":510},{},[511,513,519],{"type":49,"value":512},"Users defined in flat files on each cluster node (",{"type":43,"tag":138,"props":514,"children":516},{"className":515},[],[517],{"type":49,"value":518},"elasticsearch-users",{"type":49,"value":520}," CLI). Always active regardless of license state,\nmaking it the fallback for disaster recovery when paid realms are disabled. Only available on self-managed deployments.",{"type":43,"tag":415,"props":522,"children":524},{"className":417,"code":523,"language":419,"meta":420,"style":420},"curl -u \"${FILE_USER}:${FILE_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[525],{"type":43,"tag":138,"props":526,"children":527},{"__ignoreMap":420},[528],{"type":43,"tag":426,"props":529,"children":530},{"class":428,"line":429},[531,535,539,543,548,552,556,560,565,569,573,577,581,585],{"type":43,"tag":426,"props":532,"children":533},{"style":433},[534],{"type":49,"value":436},{"type":43,"tag":426,"props":536,"children":537},{"style":439},[538],{"type":49,"value":442},{"type":43,"tag":426,"props":540,"children":541},{"style":445},[542],{"type":49,"value":448},{"type":43,"tag":426,"props":544,"children":545},{"style":451},[546],{"type":49,"value":547},"FILE_USER",{"type":43,"tag":426,"props":549,"children":550},{"style":445},[551],{"type":49,"value":459},{"type":43,"tag":426,"props":553,"children":554},{"style":439},[555],{"type":49,"value":464},{"type":43,"tag":426,"props":557,"children":558},{"style":445},[559],{"type":49,"value":469},{"type":43,"tag":426,"props":561,"children":562},{"style":451},[563],{"type":49,"value":564},"FILE_PASSWORD",{"type":43,"tag":426,"props":566,"children":567},{"style":445},[568],{"type":49,"value":478},{"type":43,"tag":426,"props":570,"children":571},{"style":445},[572],{"type":49,"value":448},{"type":43,"tag":426,"props":574,"children":575},{"style":451},[576],{"type":49,"value":487},{"type":43,"tag":426,"props":578,"children":579},{"style":445},[580],{"type":49,"value":459},{"type":43,"tag":426,"props":582,"children":583},{"style":439},[584],{"type":49,"value":496},{"type":43,"tag":426,"props":586,"children":587},{"style":445},[588],{"type":49,"value":501},{"type":43,"tag":396,"props":590,"children":592},{"id":591},"external-realms",[593],{"type":49,"value":594},"External realms",{"type":43,"tag":403,"props":596,"children":598},{"id":597},"ldap",[599],{"type":49,"value":600},"LDAP",{"type":43,"tag":52,"props":602,"children":603},{},[604],{"type":49,"value":605},"Authenticates against an external LDAP directory using username and password. Self-managed only — not available on ECH\nor Serverless. Typically combined with role mappings to translate LDAP groups to Elasticsearch roles.",{"type":43,"tag":415,"props":607,"children":609},{"className":417,"code":608,"language":419,"meta":420,"style":420},"curl -u \"${LDAP_USER}:${LDAP_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[610],{"type":43,"tag":138,"props":611,"children":612},{"__ignoreMap":420},[613],{"type":43,"tag":426,"props":614,"children":615},{"class":428,"line":429},[616,620,624,628,633,637,641,645,650,654,658,662,666,670],{"type":43,"tag":426,"props":617,"children":618},{"style":433},[619],{"type":49,"value":436},{"type":43,"tag":426,"props":621,"children":622},{"style":439},[623],{"type":49,"value":442},{"type":43,"tag":426,"props":625,"children":626},{"style":445},[627],{"type":49,"value":448},{"type":43,"tag":426,"props":629,"children":630},{"style":451},[631],{"type":49,"value":632},"LDAP_USER",{"type":43,"tag":426,"props":634,"children":635},{"style":445},[636],{"type":49,"value":459},{"type":43,"tag":426,"props":638,"children":639},{"style":439},[640],{"type":49,"value":464},{"type":43,"tag":426,"props":642,"children":643},{"style":445},[644],{"type":49,"value":469},{"type":43,"tag":426,"props":646,"children":647},{"style":451},[648],{"type":49,"value":649},"LDAP_PASSWORD",{"type":43,"tag":426,"props":651,"children":652},{"style":445},[653],{"type":49,"value":478},{"type":43,"tag":426,"props":655,"children":656},{"style":445},[657],{"type":49,"value":448},{"type":43,"tag":426,"props":659,"children":660},{"style":451},[661],{"type":49,"value":487},{"type":43,"tag":426,"props":663,"children":664},{"style":445},[665],{"type":49,"value":459},{"type":43,"tag":426,"props":667,"children":668},{"style":439},[669],{"type":49,"value":496},{"type":43,"tag":426,"props":671,"children":672},{"style":445},[673],{"type":49,"value":501},{"type":43,"tag":52,"props":675,"children":676},{},[677],{"type":49,"value":678},"The request is identical to native — Elasticsearch routes it to the LDAP realm via the realm chain.",{"type":43,"tag":403,"props":680,"children":682},{"id":681},"active-directory",[683],{"type":49,"value":684},"Active Directory",{"type":43,"tag":52,"props":686,"children":687},{},[688,690,696],{"type":49,"value":689},"Authenticates against an Active Directory domain. Self-managed only — not available on ECH or Serverless. Similar to\nLDAP but uses AD-specific defaults (user principal name, ",{"type":43,"tag":138,"props":691,"children":693},{"className":692},[],[694],{"type":49,"value":695},"sAMAccountName",{"type":49,"value":697},"). Typically combined with role mappings for AD\ngroup-to-role translation.",{"type":43,"tag":415,"props":699,"children":701},{"className":417,"code":700,"language":419,"meta":420,"style":420},"curl -u \"${AD_USER}:${AD_PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[702],{"type":43,"tag":138,"props":703,"children":704},{"__ignoreMap":420},[705],{"type":43,"tag":426,"props":706,"children":707},{"class":428,"line":429},[708,712,716,720,725,729,733,737,742,746,750,754,758,762],{"type":43,"tag":426,"props":709,"children":710},{"style":433},[711],{"type":49,"value":436},{"type":43,"tag":426,"props":713,"children":714},{"style":439},[715],{"type":49,"value":442},{"type":43,"tag":426,"props":717,"children":718},{"style":445},[719],{"type":49,"value":448},{"type":43,"tag":426,"props":721,"children":722},{"style":451},[723],{"type":49,"value":724},"AD_USER",{"type":43,"tag":426,"props":726,"children":727},{"style":445},[728],{"type":49,"value":459},{"type":43,"tag":426,"props":730,"children":731},{"style":439},[732],{"type":49,"value":464},{"type":43,"tag":426,"props":734,"children":735},{"style":445},[736],{"type":49,"value":469},{"type":43,"tag":426,"props":738,"children":739},{"style":451},[740],{"type":49,"value":741},"AD_PASSWORD",{"type":43,"tag":426,"props":743,"children":744},{"style":445},[745],{"type":49,"value":478},{"type":43,"tag":426,"props":747,"children":748},{"style":445},[749],{"type":49,"value":448},{"type":43,"tag":426,"props":751,"children":752},{"style":451},[753],{"type":49,"value":487},{"type":43,"tag":426,"props":755,"children":756},{"style":445},[757],{"type":49,"value":459},{"type":43,"tag":426,"props":759,"children":760},{"style":439},[761],{"type":49,"value":496},{"type":43,"tag":426,"props":763,"children":764},{"style":445},[765],{"type":49,"value":501},{"type":43,"tag":403,"props":767,"children":769},{"id":768},"pki-tls-client-certificates",[770],{"type":49,"value":771},"PKI (TLS client certificates)",{"type":43,"tag":52,"props":773,"children":774},{},[775],{"type":49,"value":776},"Authenticates using X.509 client certificates presented during the TLS handshake. Requires a PKI realm and TLS on the\nHTTP layer. On ECH, PKI support is limited — check deployment settings. Not available on Serverless. Best for\nservice-to-service communication in mutual TLS environments.",{"type":43,"tag":415,"props":778,"children":780},{"className":417,"code":779,"language":419,"meta":420,"style":420},"curl --cert \"${CLIENT_CERT}\" --key \"${CLIENT_KEY}\" --cacert \"${CA_CERT}\" \\\n  \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[781],{"type":43,"tag":138,"props":782,"children":783},{"__ignoreMap":420},[784,850],{"type":43,"tag":426,"props":785,"children":786},{"class":428,"line":429},[787,791,796,800,805,809,814,818,823,827,832,836,841,845],{"type":43,"tag":426,"props":788,"children":789},{"style":433},[790],{"type":49,"value":436},{"type":43,"tag":426,"props":792,"children":793},{"style":439},[794],{"type":49,"value":795}," --cert",{"type":43,"tag":426,"props":797,"children":798},{"style":445},[799],{"type":49,"value":448},{"type":43,"tag":426,"props":801,"children":802},{"style":451},[803],{"type":49,"value":804},"CLIENT_CERT",{"type":43,"tag":426,"props":806,"children":807},{"style":445},[808],{"type":49,"value":478},{"type":43,"tag":426,"props":810,"children":811},{"style":439},[812],{"type":49,"value":813}," --key",{"type":43,"tag":426,"props":815,"children":816},{"style":445},[817],{"type":49,"value":448},{"type":43,"tag":426,"props":819,"children":820},{"style":451},[821],{"type":49,"value":822},"CLIENT_KEY",{"type":43,"tag":426,"props":824,"children":825},{"style":445},[826],{"type":49,"value":478},{"type":43,"tag":426,"props":828,"children":829},{"style":439},[830],{"type":49,"value":831}," --cacert",{"type":43,"tag":426,"props":833,"children":834},{"style":445},[835],{"type":49,"value":448},{"type":43,"tag":426,"props":837,"children":838},{"style":451},[839],{"type":49,"value":840},"CA_CERT",{"type":43,"tag":426,"props":842,"children":843},{"style":445},[844],{"type":49,"value":478},{"type":43,"tag":426,"props":846,"children":847},{"style":451},[848],{"type":49,"value":849}," \\\n",{"type":43,"tag":426,"props":851,"children":853},{"class":428,"line":852},2,[854,859,863,867,871],{"type":43,"tag":426,"props":855,"children":856},{"style":445},[857],{"type":49,"value":858},"  \"${",{"type":43,"tag":426,"props":860,"children":861},{"style":451},[862],{"type":49,"value":487},{"type":43,"tag":426,"props":864,"children":865},{"style":445},[866],{"type":49,"value":459},{"type":43,"tag":426,"props":868,"children":869},{"style":439},[870],{"type":49,"value":496},{"type":43,"tag":426,"props":872,"children":873},{"style":445},[874],{"type":49,"value":501},{"type":43,"tag":403,"props":876,"children":878},{"id":877},"saml",[879],{"type":49,"value":880},"SAML",{"type":43,"tag":52,"props":882,"children":883},{},[884,886,892],{"type":49,"value":885},"Enables SAML 2.0 Web Browser SSO, primarily for Kibana authentication. On self-managed, configure in\n",{"type":43,"tag":138,"props":887,"children":889},{"className":888},[],[890],{"type":49,"value":891},"elasticsearch.yml",{"type":49,"value":893},". On ECH, configure through the Cloud deployment settings UI. On Serverless, SAML is handled at the\norganization level and not configurable per project. Not usable by standard REST clients — the browser-based redirect\nflow is handled by Kibana. Configure another realm (e.g. native or API keys) alongside SAML for programmatic API access.",{"type":43,"tag":403,"props":895,"children":897},{"id":896},"oidc-openid-connect",[898],{"type":49,"value":899},"OIDC (OpenID Connect)",{"type":43,"tag":52,"props":901,"children":902},{},[903,905,910],{"type":49,"value":904},"Enables OpenID Connect SSO, primarily for Kibana authentication. On self-managed, configure in ",{"type":43,"tag":138,"props":906,"children":908},{"className":907},[],[909],{"type":49,"value":891},{"type":49,"value":911},". On\nECH, configure through the Cloud deployment settings UI. Not available on Serverless. Like SAML, it relies on browser\nredirects and is not suited for direct REST client use. For programmatic access alongside OIDC, use API keys or native\nusers.",{"type":43,"tag":52,"props":913,"children":914},{},[915,917,923],{"type":49,"value":916},"Custom applications can exchange OIDC tokens for Elasticsearch access tokens via ",{"type":43,"tag":138,"props":918,"children":920},{"className":919},[],[921],{"type":49,"value":922},"POST \u002F_security\u002Foidc\u002Fauthenticate",{"type":49,"value":924},",\nbut this requires implementing the full OIDC redirect flow.",{"type":43,"tag":403,"props":926,"children":928},{"id":927},"jwt-json-web-tokens",[929],{"type":49,"value":930},"JWT (JSON Web Tokens)",{"type":43,"tag":52,"props":932,"children":933},{},[934,936,941],{"type":49,"value":935},"Accepts JWTs issued by an external identity provider as bearer tokens. On self-managed, configure in\n",{"type":43,"tag":138,"props":937,"children":939},{"className":938},[],[940],{"type":49,"value":891},{"type":49,"value":942},". On ECH, configure through the Cloud deployment settings UI. Not available on Serverless. Supports\ntwo token types:",{"type":43,"tag":113,"props":944,"children":945},{},[946,960],{"type":43,"tag":117,"props":947,"children":948},{},[949,958],{"type":43,"tag":63,"props":950,"children":951},{},[952],{"type":43,"tag":138,"props":953,"children":955},{"className":954},[],[956],{"type":49,"value":957},"id_token",{"type":49,"value":959}," (default) — OpenID Connect ID tokens for user-on-behalf-of flows.",{"type":43,"tag":117,"props":961,"children":962},{},[963,972],{"type":43,"tag":63,"props":964,"children":965},{},[966],{"type":43,"tag":138,"props":967,"children":969},{"className":968},[],[970],{"type":49,"value":971},"access_token",{"type":49,"value":973}," — OAuth2 client credentials for application identity flows.",{"type":43,"tag":415,"props":975,"children":977},{"className":417,"code":976,"language":419,"meta":420,"style":420},"curl -H \"Authorization: Bearer ${JWT_TOKEN}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[978],{"type":43,"tag":138,"props":979,"children":980},{"__ignoreMap":420},[981],{"type":43,"tag":426,"props":982,"children":983},{"class":428,"line":429},[984,988,993,998,1003,1007,1012,1016,1020,1024,1028,1032],{"type":43,"tag":426,"props":985,"children":986},{"style":433},[987],{"type":49,"value":436},{"type":43,"tag":426,"props":989,"children":990},{"style":439},[991],{"type":49,"value":992}," -H",{"type":43,"tag":426,"props":994,"children":995},{"style":445},[996],{"type":49,"value":997}," \"",{"type":43,"tag":426,"props":999,"children":1000},{"style":439},[1001],{"type":49,"value":1002},"Authorization: Bearer ",{"type":43,"tag":426,"props":1004,"children":1005},{"style":445},[1006],{"type":49,"value":469},{"type":43,"tag":426,"props":1008,"children":1009},{"style":451},[1010],{"type":49,"value":1011},"JWT_TOKEN",{"type":43,"tag":426,"props":1013,"children":1014},{"style":445},[1015],{"type":49,"value":478},{"type":43,"tag":426,"props":1017,"children":1018},{"style":445},[1019],{"type":49,"value":448},{"type":43,"tag":426,"props":1021,"children":1022},{"style":451},[1023],{"type":49,"value":487},{"type":43,"tag":426,"props":1025,"children":1026},{"style":445},[1027],{"type":49,"value":459},{"type":43,"tag":426,"props":1029,"children":1030},{"style":439},[1031],{"type":49,"value":496},{"type":43,"tag":426,"props":1033,"children":1034},{"style":445},[1035],{"type":49,"value":501},{"type":43,"tag":52,"props":1037,"children":1038},{},[1039,1041,1046,1048,1053],{"type":49,"value":1040},"Each JWT realm handles one token type. Configure separate realms for ",{"type":43,"tag":138,"props":1042,"children":1044},{"className":1043},[],[1045],{"type":49,"value":957},{"type":49,"value":1047}," and ",{"type":43,"tag":138,"props":1049,"children":1051},{"className":1050},[],[1052],{"type":49,"value":971},{"type":49,"value":1054}," if both are needed.",{"type":43,"tag":403,"props":1056,"children":1058},{"id":1057},"kerberos",[1059],{"type":49,"value":1060},"Kerberos",{"type":43,"tag":52,"props":1062,"children":1063},{},[1064],{"type":49,"value":1065},"Authenticates using Kerberos tickets via the SPNEGO mechanism. Self-managed only — not available on ECH or Serverless.\nRequires a working KDC infrastructure, proper DNS, and time synchronization.",{"type":43,"tag":415,"props":1067,"children":1069},{"className":417,"code":1068,"language":419,"meta":420,"style":420},"kinit \"${KERBEROS_PRINCIPAL}\"\ncurl --negotiate -u : \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[1070],{"type":43,"tag":138,"props":1071,"children":1072},{"__ignoreMap":420},[1073,1095],{"type":43,"tag":426,"props":1074,"children":1075},{"class":428,"line":429},[1076,1081,1085,1090],{"type":43,"tag":426,"props":1077,"children":1078},{"style":433},[1079],{"type":49,"value":1080},"kinit",{"type":43,"tag":426,"props":1082,"children":1083},{"style":445},[1084],{"type":49,"value":448},{"type":43,"tag":426,"props":1086,"children":1087},{"style":451},[1088],{"type":49,"value":1089},"KERBEROS_PRINCIPAL",{"type":43,"tag":426,"props":1091,"children":1092},{"style":445},[1093],{"type":49,"value":1094},"}\"\n",{"type":43,"tag":426,"props":1096,"children":1097},{"class":428,"line":852},[1098,1102,1107,1111,1116,1120,1124,1128,1132],{"type":43,"tag":426,"props":1099,"children":1100},{"style":433},[1101],{"type":49,"value":436},{"type":43,"tag":426,"props":1103,"children":1104},{"style":439},[1105],{"type":49,"value":1106}," --negotiate",{"type":43,"tag":426,"props":1108,"children":1109},{"style":439},[1110],{"type":49,"value":442},{"type":43,"tag":426,"props":1112,"children":1113},{"style":439},[1114],{"type":49,"value":1115}," :",{"type":43,"tag":426,"props":1117,"children":1118},{"style":445},[1119],{"type":49,"value":448},{"type":43,"tag":426,"props":1121,"children":1122},{"style":451},[1123],{"type":49,"value":487},{"type":43,"tag":426,"props":1125,"children":1126},{"style":445},[1127],{"type":49,"value":459},{"type":43,"tag":426,"props":1129,"children":1130},{"style":439},[1131],{"type":49,"value":496},{"type":43,"tag":426,"props":1133,"children":1134},{"style":445},[1135],{"type":49,"value":501},{"type":43,"tag":52,"props":1137,"children":1138},{},[1139,1141,1147,1149,1155,1157,1162],{"type":49,"value":1140},"The ",{"type":43,"tag":138,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":49,"value":1146},"--negotiate",{"type":49,"value":1148}," flag enables SPNEGO. The ",{"type":43,"tag":138,"props":1150,"children":1152},{"className":1151},[],[1153],{"type":49,"value":1154},"-u :",{"type":49,"value":1156}," is required by curl but the username is ignored — the principal from\n",{"type":43,"tag":138,"props":1158,"children":1160},{"className":1159},[],[1161],{"type":49,"value":1080},{"type":49,"value":1163}," is used. Requires curl 7.49+ with GSS-API\u002FSPNEGO support.",{"type":43,"tag":396,"props":1165,"children":1167},{"id":1166},"api-keys",[1168],{"type":49,"value":1169},"API keys",{"type":43,"tag":52,"props":1171,"children":1172},{},[1173,1175,1181],{"type":49,"value":1174},"Not a realm, but a distinct authentication mechanism. Pass a Base64-encoded API key in the ",{"type":43,"tag":138,"props":1176,"children":1178},{"className":1177},[],[1179],{"type":49,"value":1180},"Authorization",{"type":49,"value":1182}," header.\nPreferred for programmatic and automated access.",{"type":43,"tag":415,"props":1184,"children":1186},{"className":417,"code":1185,"language":419,"meta":420,"style":420},"curl -H \"Authorization: ApiKey ${ELASTICSEARCH_API_KEY}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[1187],{"type":43,"tag":138,"props":1188,"children":1189},{"__ignoreMap":420},[1190],{"type":43,"tag":426,"props":1191,"children":1192},{"class":428,"line":429},[1193,1197,1201,1205,1210,1214,1218,1222,1226,1230,1234,1238],{"type":43,"tag":426,"props":1194,"children":1195},{"style":433},[1196],{"type":49,"value":436},{"type":43,"tag":426,"props":1198,"children":1199},{"style":439},[1200],{"type":49,"value":992},{"type":43,"tag":426,"props":1202,"children":1203},{"style":445},[1204],{"type":49,"value":997},{"type":43,"tag":426,"props":1206,"children":1207},{"style":439},[1208],{"type":49,"value":1209},"Authorization: ApiKey ",{"type":43,"tag":426,"props":1211,"children":1212},{"style":445},[1213],{"type":49,"value":469},{"type":43,"tag":426,"props":1215,"children":1216},{"style":451},[1217],{"type":49,"value":151},{"type":43,"tag":426,"props":1219,"children":1220},{"style":445},[1221],{"type":49,"value":478},{"type":43,"tag":426,"props":1223,"children":1224},{"style":445},[1225],{"type":49,"value":448},{"type":43,"tag":426,"props":1227,"children":1228},{"style":451},[1229],{"type":49,"value":487},{"type":43,"tag":426,"props":1231,"children":1232},{"style":445},[1233],{"type":49,"value":459},{"type":43,"tag":426,"props":1235,"children":1236},{"style":439},[1237],{"type":49,"value":496},{"type":43,"tag":426,"props":1239,"children":1240},{"style":445},[1241],{"type":49,"value":501},{"type":43,"tag":52,"props":1243,"children":1244},{},[1245,1250,1252,1258,1260,1266],{"type":43,"tag":138,"props":1246,"children":1248},{"className":1247},[],[1249],{"type":49,"value":151},{"type":49,"value":1251}," is the ",{"type":43,"tag":138,"props":1253,"children":1255},{"className":1254},[],[1256],{"type":49,"value":1257},"encoded",{"type":49,"value":1259}," value (Base64 of ",{"type":43,"tag":138,"props":1261,"children":1263},{"className":1262},[],[1264],{"type":49,"value":1265},"id:api_key",{"type":49,"value":1267},") returned when the key was created.",{"type":43,"tag":396,"props":1269,"children":1271},{"id":1270},"verify-authentication",[1272],{"type":49,"value":1273},"Verify authentication",{"type":43,"tag":52,"props":1275,"children":1276},{},[1277],{"type":49,"value":1278},"Always verify credentials before proceeding:",{"type":43,"tag":415,"props":1280,"children":1282},{"className":417,"code":1281,"language":419,"meta":420,"style":420},"curl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[1283],{"type":43,"tag":138,"props":1284,"children":1285},{"__ignoreMap":420},[1286],{"type":43,"tag":426,"props":1287,"children":1288},{"class":428,"line":429},[1289,1293,1298,1303,1308,1313,1317,1321,1325,1329],{"type":43,"tag":426,"props":1290,"children":1291},{"style":433},[1292],{"type":49,"value":436},{"type":43,"tag":426,"props":1294,"children":1295},{"style":445},[1296],{"type":49,"value":1297}," \u003C",{"type":43,"tag":426,"props":1299,"children":1300},{"style":439},[1301],{"type":49,"value":1302},"auth_flag",{"type":43,"tag":426,"props":1304,"children":1305},{"style":451},[1306],{"type":49,"value":1307},"s",{"type":43,"tag":426,"props":1309,"children":1310},{"style":445},[1311],{"type":49,"value":1312},">",{"type":43,"tag":426,"props":1314,"children":1315},{"style":445},[1316],{"type":49,"value":448},{"type":43,"tag":426,"props":1318,"children":1319},{"style":451},[1320],{"type":49,"value":487},{"type":43,"tag":426,"props":1322,"children":1323},{"style":445},[1324],{"type":49,"value":459},{"type":43,"tag":426,"props":1326,"children":1327},{"style":439},[1328],{"type":49,"value":496},{"type":43,"tag":426,"props":1330,"children":1331},{"style":445},[1332],{"type":49,"value":501},{"type":43,"tag":52,"props":1334,"children":1335},{},[1336,1338,1344,1345,1351,1353,1359],{"type":49,"value":1337},"Check ",{"type":43,"tag":138,"props":1339,"children":1341},{"className":1340},[],[1342],{"type":49,"value":1343},"username",{"type":49,"value":145},{"type":43,"tag":138,"props":1346,"children":1348},{"className":1347},[],[1349],{"type":49,"value":1350},"roles",{"type":49,"value":1352},", and ",{"type":43,"tag":138,"props":1354,"children":1356},{"className":1355},[],[1357],{"type":49,"value":1358},"authentication_realm.type",{"type":49,"value":1360}," to confirm identity and method:",{"type":43,"tag":268,"props":1362,"children":1363},{},[1364,1383],{"type":43,"tag":272,"props":1365,"children":1366},{},[1367],{"type":43,"tag":276,"props":1368,"children":1369},{},[1370,1378],{"type":43,"tag":280,"props":1371,"children":1372},{},[1373],{"type":43,"tag":138,"props":1374,"children":1376},{"className":1375},[],[1377],{"type":49,"value":1358},{"type":43,"tag":280,"props":1379,"children":1380},{},[1381],{"type":49,"value":1382},"Realm",{"type":43,"tag":291,"props":1384,"children":1385},{},[1386,1403,1418,1433,1449,1466,1481,1498,1515],{"type":43,"tag":276,"props":1387,"children":1388},{},[1389,1398],{"type":43,"tag":298,"props":1390,"children":1391},{},[1392],{"type":43,"tag":138,"props":1393,"children":1395},{"className":1394},[],[1396],{"type":49,"value":1397},"native",{"type":43,"tag":298,"props":1399,"children":1400},{},[1401],{"type":49,"value":1402},"Native",{"type":43,"tag":276,"props":1404,"children":1405},{},[1406,1414],{"type":43,"tag":298,"props":1407,"children":1408},{},[1409],{"type":43,"tag":138,"props":1410,"children":1412},{"className":1411},[],[1413],{"type":49,"value":504},{"type":43,"tag":298,"props":1415,"children":1416},{},[1417],{"type":49,"value":507},{"type":43,"tag":276,"props":1419,"children":1420},{},[1421,1429],{"type":43,"tag":298,"props":1422,"children":1423},{},[1424],{"type":43,"tag":138,"props":1425,"children":1427},{"className":1426},[],[1428],{"type":49,"value":597},{"type":43,"tag":298,"props":1430,"children":1431},{},[1432],{"type":49,"value":600},{"type":43,"tag":276,"props":1434,"children":1435},{},[1436,1445],{"type":43,"tag":298,"props":1437,"children":1438},{},[1439],{"type":43,"tag":138,"props":1440,"children":1442},{"className":1441},[],[1443],{"type":49,"value":1444},"active_directory",{"type":43,"tag":298,"props":1446,"children":1447},{},[1448],{"type":49,"value":684},{"type":43,"tag":276,"props":1450,"children":1451},{},[1452,1461],{"type":43,"tag":298,"props":1453,"children":1454},{},[1455],{"type":43,"tag":138,"props":1456,"children":1458},{"className":1457},[],[1459],{"type":49,"value":1460},"pki",{"type":43,"tag":298,"props":1462,"children":1463},{},[1464],{"type":49,"value":1465},"PKI",{"type":43,"tag":276,"props":1467,"children":1468},{},[1469,1477],{"type":43,"tag":298,"props":1470,"children":1471},{},[1472],{"type":43,"tag":138,"props":1473,"children":1475},{"className":1474},[],[1476],{"type":49,"value":877},{"type":43,"tag":298,"props":1478,"children":1479},{},[1480],{"type":49,"value":880},{"type":43,"tag":276,"props":1482,"children":1483},{},[1484,1493],{"type":43,"tag":298,"props":1485,"children":1486},{},[1487],{"type":43,"tag":138,"props":1488,"children":1490},{"className":1489},[],[1491],{"type":49,"value":1492},"oidc",{"type":43,"tag":298,"props":1494,"children":1495},{},[1496],{"type":49,"value":1497},"OpenID Connect",{"type":43,"tag":276,"props":1499,"children":1500},{},[1501,1510],{"type":43,"tag":298,"props":1502,"children":1503},{},[1504],{"type":43,"tag":138,"props":1505,"children":1507},{"className":1506},[],[1508],{"type":49,"value":1509},"jwt",{"type":43,"tag":298,"props":1511,"children":1512},{},[1513],{"type":49,"value":1514},"JWT",{"type":43,"tag":276,"props":1516,"children":1517},{},[1518,1526],{"type":43,"tag":298,"props":1519,"children":1520},{},[1521],{"type":43,"tag":138,"props":1522,"children":1524},{"className":1523},[],[1525],{"type":49,"value":1057},{"type":43,"tag":298,"props":1527,"children":1528},{},[1529],{"type":49,"value":1060},{"type":43,"tag":52,"props":1531,"children":1532},{},[1533,1535,1541,1543,1549],{"type":49,"value":1534},"For API keys, ",{"type":43,"tag":138,"props":1536,"children":1538},{"className":1537},[],[1539],{"type":49,"value":1540},"authentication_type",{"type":49,"value":1542}," is ",{"type":43,"tag":138,"props":1544,"children":1546},{"className":1545},[],[1547],{"type":49,"value":1548},"\"api_key\"",{"type":49,"value":1550}," (not a realm type).",{"type":43,"tag":106,"props":1552,"children":1554},{"id":1553},"manage-api-keys",[1555],{"type":49,"value":1556},"Manage API Keys",{"type":43,"tag":396,"props":1558,"children":1560},{"id":1559},"create-an-api-key",[1561],{"type":49,"value":1562},"Create an API key",{"type":43,"tag":415,"props":1564,"children":1566},{"className":417,"code":1565,"language":419,"meta":420,"style":420},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"'\"${KEY_NAME}\"'\",\n    \"expiration\": \"30d\",\n    \"role_descriptors\": {\n      \"'\"${ROLE_NAME}\"'\": {\n        \"cluster\": [],\n        \"indices\": [\n          {\n            \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n            \"privileges\": [\"read\"]\n          }\n        ]\n      }\n    }\n  }'\n",[1567],{"type":43,"tag":138,"props":1568,"children":1569},{"__ignoreMap":420},[1570,1613,1637,1663,1682,1711,1720,1729,1756,1765,1774,1783,1810,1819,1828,1837,1846,1855],{"type":43,"tag":426,"props":1571,"children":1572},{"class":428,"line":429},[1573,1577,1582,1587,1591,1595,1599,1604,1609],{"type":43,"tag":426,"props":1574,"children":1575},{"style":433},[1576],{"type":49,"value":436},{"type":43,"tag":426,"props":1578,"children":1579},{"style":439},[1580],{"type":49,"value":1581}," -X",{"type":43,"tag":426,"props":1583,"children":1584},{"style":439},[1585],{"type":49,"value":1586}," POST",{"type":43,"tag":426,"props":1588,"children":1589},{"style":445},[1590],{"type":49,"value":448},{"type":43,"tag":426,"props":1592,"children":1593},{"style":451},[1594],{"type":49,"value":487},{"type":43,"tag":426,"props":1596,"children":1597},{"style":445},[1598],{"type":49,"value":459},{"type":43,"tag":426,"props":1600,"children":1601},{"style":439},[1602],{"type":49,"value":1603},"\u002F_security\u002Fapi_key",{"type":43,"tag":426,"props":1605,"children":1606},{"style":445},[1607],{"type":49,"value":1608},"\"",{"type":43,"tag":426,"props":1610,"children":1611},{"style":451},[1612],{"type":49,"value":849},{"type":43,"tag":426,"props":1614,"children":1615},{"class":428,"line":852},[1616,1621,1625,1629,1633],{"type":43,"tag":426,"props":1617,"children":1618},{"style":445},[1619],{"type":49,"value":1620},"  \u003C",{"type":43,"tag":426,"props":1622,"children":1623},{"style":439},[1624],{"type":49,"value":1302},{"type":43,"tag":426,"props":1626,"children":1627},{"style":451},[1628],{"type":49,"value":1307},{"type":43,"tag":426,"props":1630,"children":1631},{"style":445},[1632],{"type":49,"value":1312},{"type":43,"tag":426,"props":1634,"children":1635},{"style":451},[1636],{"type":49,"value":849},{"type":43,"tag":426,"props":1638,"children":1640},{"class":428,"line":1639},3,[1641,1646,1650,1655,1659],{"type":43,"tag":426,"props":1642,"children":1643},{"style":439},[1644],{"type":49,"value":1645},"  -H",{"type":43,"tag":426,"props":1647,"children":1648},{"style":445},[1649],{"type":49,"value":997},{"type":43,"tag":426,"props":1651,"children":1652},{"style":439},[1653],{"type":49,"value":1654},"Content-Type: application\u002Fjson",{"type":43,"tag":426,"props":1656,"children":1657},{"style":445},[1658],{"type":49,"value":1608},{"type":43,"tag":426,"props":1660,"children":1661},{"style":451},[1662],{"type":49,"value":849},{"type":43,"tag":426,"props":1664,"children":1666},{"class":428,"line":1665},4,[1667,1672,1677],{"type":43,"tag":426,"props":1668,"children":1669},{"style":439},[1670],{"type":49,"value":1671},"  -d",{"type":43,"tag":426,"props":1673,"children":1674},{"style":445},[1675],{"type":49,"value":1676}," '",{"type":43,"tag":426,"props":1678,"children":1679},{"style":439},[1680],{"type":49,"value":1681},"{\n",{"type":43,"tag":426,"props":1683,"children":1685},{"class":428,"line":1684},5,[1686,1691,1696,1701,1706],{"type":43,"tag":426,"props":1687,"children":1688},{"style":439},[1689],{"type":49,"value":1690},"    \"name\": \"",{"type":43,"tag":426,"props":1692,"children":1693},{"style":445},[1694],{"type":49,"value":1695},"'\"${",{"type":43,"tag":426,"props":1697,"children":1698},{"style":451},[1699],{"type":49,"value":1700},"KEY_NAME",{"type":43,"tag":426,"props":1702,"children":1703},{"style":445},[1704],{"type":49,"value":1705},"}\"'",{"type":43,"tag":426,"props":1707,"children":1708},{"style":439},[1709],{"type":49,"value":1710},"\",\n",{"type":43,"tag":426,"props":1712,"children":1714},{"class":428,"line":1713},6,[1715],{"type":43,"tag":426,"props":1716,"children":1717},{"style":439},[1718],{"type":49,"value":1719},"    \"expiration\": \"30d\",\n",{"type":43,"tag":426,"props":1721,"children":1723},{"class":428,"line":1722},7,[1724],{"type":43,"tag":426,"props":1725,"children":1726},{"style":439},[1727],{"type":49,"value":1728},"    \"role_descriptors\": {\n",{"type":43,"tag":426,"props":1730,"children":1732},{"class":428,"line":1731},8,[1733,1738,1742,1747,1751],{"type":43,"tag":426,"props":1734,"children":1735},{"style":439},[1736],{"type":49,"value":1737},"      \"",{"type":43,"tag":426,"props":1739,"children":1740},{"style":445},[1741],{"type":49,"value":1695},{"type":43,"tag":426,"props":1743,"children":1744},{"style":451},[1745],{"type":49,"value":1746},"ROLE_NAME",{"type":43,"tag":426,"props":1748,"children":1749},{"style":445},[1750],{"type":49,"value":1705},{"type":43,"tag":426,"props":1752,"children":1753},{"style":439},[1754],{"type":49,"value":1755},"\": {\n",{"type":43,"tag":426,"props":1757,"children":1759},{"class":428,"line":1758},9,[1760],{"type":43,"tag":426,"props":1761,"children":1762},{"style":439},[1763],{"type":49,"value":1764},"        \"cluster\": [],\n",{"type":43,"tag":426,"props":1766,"children":1768},{"class":428,"line":1767},10,[1769],{"type":43,"tag":426,"props":1770,"children":1771},{"style":439},[1772],{"type":49,"value":1773},"        \"indices\": [\n",{"type":43,"tag":426,"props":1775,"children":1777},{"class":428,"line":1776},11,[1778],{"type":43,"tag":426,"props":1779,"children":1780},{"style":439},[1781],{"type":49,"value":1782},"          {\n",{"type":43,"tag":426,"props":1784,"children":1786},{"class":428,"line":1785},12,[1787,1792,1796,1801,1805],{"type":43,"tag":426,"props":1788,"children":1789},{"style":439},[1790],{"type":49,"value":1791},"            \"names\": [\"",{"type":43,"tag":426,"props":1793,"children":1794},{"style":445},[1795],{"type":49,"value":1695},{"type":43,"tag":426,"props":1797,"children":1798},{"style":451},[1799],{"type":49,"value":1800},"INDEX_PATTERN",{"type":43,"tag":426,"props":1802,"children":1803},{"style":445},[1804],{"type":49,"value":1705},{"type":43,"tag":426,"props":1806,"children":1807},{"style":439},[1808],{"type":49,"value":1809},"\"],\n",{"type":43,"tag":426,"props":1811,"children":1813},{"class":428,"line":1812},13,[1814],{"type":43,"tag":426,"props":1815,"children":1816},{"style":439},[1817],{"type":49,"value":1818},"            \"privileges\": [\"read\"]\n",{"type":43,"tag":426,"props":1820,"children":1822},{"class":428,"line":1821},14,[1823],{"type":43,"tag":426,"props":1824,"children":1825},{"style":439},[1826],{"type":49,"value":1827},"          }\n",{"type":43,"tag":426,"props":1829,"children":1831},{"class":428,"line":1830},15,[1832],{"type":43,"tag":426,"props":1833,"children":1834},{"style":439},[1835],{"type":49,"value":1836},"        ]\n",{"type":43,"tag":426,"props":1838,"children":1840},{"class":428,"line":1839},16,[1841],{"type":43,"tag":426,"props":1842,"children":1843},{"style":439},[1844],{"type":49,"value":1845},"      }\n",{"type":43,"tag":426,"props":1847,"children":1849},{"class":428,"line":1848},17,[1850],{"type":43,"tag":426,"props":1851,"children":1852},{"style":439},[1853],{"type":49,"value":1854},"    }\n",{"type":43,"tag":426,"props":1856,"children":1858},{"class":428,"line":1857},18,[1859,1864],{"type":43,"tag":426,"props":1860,"children":1861},{"style":439},[1862],{"type":49,"value":1863},"  }",{"type":43,"tag":426,"props":1865,"children":1866},{"style":445},[1867],{"type":49,"value":1868},"'\n",{"type":43,"tag":52,"props":1870,"children":1871},{},[1872,1874,1880,1881,1887,1888,1893,1895,1900],{"type":49,"value":1873},"The response contains ",{"type":43,"tag":138,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":49,"value":1879},"id",{"type":49,"value":145},{"type":43,"tag":138,"props":1882,"children":1884},{"className":1883},[],[1885],{"type":49,"value":1886},"api_key",{"type":49,"value":1352},{"type":43,"tag":138,"props":1889,"children":1891},{"className":1890},[],[1892],{"type":49,"value":1257},{"type":49,"value":1894},". Store ",{"type":43,"tag":138,"props":1896,"children":1898},{"className":1897},[],[1899],{"type":49,"value":1257},{"type":49,"value":1901}," securely — it cannot be retrieved again.",{"type":43,"tag":52,"props":1903,"children":1904},{},[1905,1907,1913],{"type":49,"value":1906},"Omit ",{"type":43,"tag":138,"props":1908,"children":1910},{"className":1909},[],[1911],{"type":49,"value":1912},"role_descriptors",{"type":49,"value":1914}," to inherit a snapshot of the authenticated user's current privileges.",{"type":43,"tag":84,"props":1916,"children":1917},{},[1918],{"type":43,"tag":52,"props":1919,"children":1920},{},[1921,1926,1928,1933,1935,1941],{"type":43,"tag":63,"props":1922,"children":1923},{},[1924],{"type":49,"value":1925},"Limitation:",{"type":49,"value":1927}," An API key ",{"type":43,"tag":63,"props":1929,"children":1930},{},[1931],{"type":49,"value":1932},"cannot",{"type":49,"value":1934}," create another API key with privileges. The derived key is created with no\neffective access. Use ",{"type":43,"tag":138,"props":1936,"children":1938},{"className":1937},[],[1939],{"type":49,"value":1940},"POST \u002F_security\u002Fapi_key\u002Fgrant",{"type":49,"value":1942}," with user credentials instead.",{"type":43,"tag":396,"props":1944,"children":1946},{"id":1945},"get-and-invalidate-api-keys",[1947],{"type":49,"value":1948},"Get and invalidate API keys",{"type":43,"tag":415,"props":1950,"children":1952},{"className":417,"code":1951,"language":419,"meta":420,"style":420},"curl \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=${KEY_NAME}\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"'\"${KEY_NAME}\"'\"}'\n",[1953],{"type":43,"tag":138,"props":1954,"children":1955},{"__ignoreMap":420},[1956,2009,2049,2072,2095],{"type":43,"tag":426,"props":1957,"children":1958},{"class":428,"line":429},[1959,1963,1967,1971,1975,1980,1984,1988,1992,1996,2000,2004],{"type":43,"tag":426,"props":1960,"children":1961},{"style":433},[1962],{"type":49,"value":436},{"type":43,"tag":426,"props":1964,"children":1965},{"style":445},[1966],{"type":49,"value":448},{"type":43,"tag":426,"props":1968,"children":1969},{"style":451},[1970],{"type":49,"value":487},{"type":43,"tag":426,"props":1972,"children":1973},{"style":445},[1974],{"type":49,"value":459},{"type":43,"tag":426,"props":1976,"children":1977},{"style":439},[1978],{"type":49,"value":1979},"\u002F_security\u002Fapi_key?name=",{"type":43,"tag":426,"props":1981,"children":1982},{"style":445},[1983],{"type":49,"value":469},{"type":43,"tag":426,"props":1985,"children":1986},{"style":451},[1987],{"type":49,"value":1700},{"type":43,"tag":426,"props":1989,"children":1990},{"style":445},[1991],{"type":49,"value":478},{"type":43,"tag":426,"props":1993,"children":1994},{"style":445},[1995],{"type":49,"value":1297},{"type":43,"tag":426,"props":1997,"children":1998},{"style":439},[1999],{"type":49,"value":1302},{"type":43,"tag":426,"props":2001,"children":2002},{"style":451},[2003],{"type":49,"value":1307},{"type":43,"tag":426,"props":2005,"children":2006},{"style":445},[2007],{"type":49,"value":2008},">\n",{"type":43,"tag":426,"props":2010,"children":2011},{"class":428,"line":852},[2012,2016,2020,2025,2029,2033,2037,2041,2045],{"type":43,"tag":426,"props":2013,"children":2014},{"style":433},[2015],{"type":49,"value":436},{"type":43,"tag":426,"props":2017,"children":2018},{"style":439},[2019],{"type":49,"value":1581},{"type":43,"tag":426,"props":2021,"children":2022},{"style":439},[2023],{"type":49,"value":2024}," DELETE",{"type":43,"tag":426,"props":2026,"children":2027},{"style":445},[2028],{"type":49,"value":448},{"type":43,"tag":426,"props":2030,"children":2031},{"style":451},[2032],{"type":49,"value":487},{"type":43,"tag":426,"props":2034,"children":2035},{"style":445},[2036],{"type":49,"value":459},{"type":43,"tag":426,"props":2038,"children":2039},{"style":439},[2040],{"type":49,"value":1603},{"type":43,"tag":426,"props":2042,"children":2043},{"style":445},[2044],{"type":49,"value":1608},{"type":43,"tag":426,"props":2046,"children":2047},{"style":451},[2048],{"type":49,"value":849},{"type":43,"tag":426,"props":2050,"children":2051},{"class":428,"line":1639},[2052,2056,2060,2064,2068],{"type":43,"tag":426,"props":2053,"children":2054},{"style":445},[2055],{"type":49,"value":1620},{"type":43,"tag":426,"props":2057,"children":2058},{"style":439},[2059],{"type":49,"value":1302},{"type":43,"tag":426,"props":2061,"children":2062},{"style":451},[2063],{"type":49,"value":1307},{"type":43,"tag":426,"props":2065,"children":2066},{"style":445},[2067],{"type":49,"value":1312},{"type":43,"tag":426,"props":2069,"children":2070},{"style":451},[2071],{"type":49,"value":849},{"type":43,"tag":426,"props":2073,"children":2074},{"class":428,"line":1665},[2075,2079,2083,2087,2091],{"type":43,"tag":426,"props":2076,"children":2077},{"style":439},[2078],{"type":49,"value":1645},{"type":43,"tag":426,"props":2080,"children":2081},{"style":445},[2082],{"type":49,"value":997},{"type":43,"tag":426,"props":2084,"children":2085},{"style":439},[2086],{"type":49,"value":1654},{"type":43,"tag":426,"props":2088,"children":2089},{"style":445},[2090],{"type":49,"value":1608},{"type":43,"tag":426,"props":2092,"children":2093},{"style":451},[2094],{"type":49,"value":849},{"type":43,"tag":426,"props":2096,"children":2097},{"class":428,"line":1684},[2098,2102,2106,2111,2115,2119,2123,2128],{"type":43,"tag":426,"props":2099,"children":2100},{"style":439},[2101],{"type":49,"value":1671},{"type":43,"tag":426,"props":2103,"children":2104},{"style":445},[2105],{"type":49,"value":1676},{"type":43,"tag":426,"props":2107,"children":2108},{"style":439},[2109],{"type":49,"value":2110},"{\"name\": \"",{"type":43,"tag":426,"props":2112,"children":2113},{"style":445},[2114],{"type":49,"value":1695},{"type":43,"tag":426,"props":2116,"children":2117},{"style":451},[2118],{"type":49,"value":1700},{"type":43,"tag":426,"props":2120,"children":2121},{"style":445},[2122],{"type":49,"value":1705},{"type":43,"tag":426,"props":2124,"children":2125},{"style":439},[2126],{"type":49,"value":2127},"\"}",{"type":43,"tag":426,"props":2129,"children":2130},{"style":445},[2131],{"type":49,"value":1868},{"type":43,"tag":106,"props":2133,"children":2135},{"id":2134},"examples",[2136],{"type":49,"value":2137},"Examples",{"type":43,"tag":396,"props":2139,"children":2141},{"id":2140},"create-a-scoped-api-key",[2142],{"type":49,"value":2143},"Create a scoped API key",{"type":43,"tag":52,"props":2145,"children":2146},{},[2147,2152,2154,2160],{"type":43,"tag":63,"props":2148,"children":2149},{},[2150],{"type":49,"value":2151},"Request:",{"type":49,"value":2153}," \"Create an API key that can only read from ",{"type":43,"tag":138,"props":2155,"children":2157},{"className":2156},[],[2158],{"type":49,"value":2159},"metrics-*",{"type":49,"value":2161},".\"",{"type":43,"tag":415,"props":2163,"children":2167},{"className":2164,"code":2165,"language":2166,"meta":420,"style":420},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","POST \u002F_security\u002Fapi_key\n{\n  \"name\": \"metrics-reader-key\",\n  \"expiration\": \"90d\",\n  \"role_descriptors\": {\n    \"metrics-reader\": {\n      \"indices\": [\n        {\n          \"names\": [\"metrics-*\"],\n          \"privileges\": [\"read\", \"view_index_metadata\"]\n        }\n      ]\n    }\n  }\n}\n","json",[2168],{"type":43,"tag":138,"props":2169,"children":2170},{"__ignoreMap":420},[2171,2179,2186,2226,2263,2287,2312,2338,2346,2390,2450,2458,2466,2473,2481],{"type":43,"tag":426,"props":2172,"children":2173},{"class":428,"line":429},[2174],{"type":43,"tag":426,"props":2175,"children":2176},{"style":451},[2177],{"type":49,"value":2178},"POST \u002F_security\u002Fapi_key\n",{"type":43,"tag":426,"props":2180,"children":2181},{"class":428,"line":852},[2182],{"type":43,"tag":426,"props":2183,"children":2184},{"style":445},[2185],{"type":49,"value":1681},{"type":43,"tag":426,"props":2187,"children":2188},{"class":428,"line":1639},[2189,2194,2200,2204,2208,2212,2217,2221],{"type":43,"tag":426,"props":2190,"children":2191},{"style":445},[2192],{"type":49,"value":2193},"  \"",{"type":43,"tag":426,"props":2195,"children":2197},{"style":2196},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2198],{"type":49,"value":2199},"name",{"type":43,"tag":426,"props":2201,"children":2202},{"style":445},[2203],{"type":49,"value":1608},{"type":43,"tag":426,"props":2205,"children":2206},{"style":445},[2207],{"type":49,"value":464},{"type":43,"tag":426,"props":2209,"children":2210},{"style":445},[2211],{"type":49,"value":997},{"type":43,"tag":426,"props":2213,"children":2214},{"style":439},[2215],{"type":49,"value":2216},"metrics-reader-key",{"type":43,"tag":426,"props":2218,"children":2219},{"style":445},[2220],{"type":49,"value":1608},{"type":43,"tag":426,"props":2222,"children":2223},{"style":445},[2224],{"type":49,"value":2225},",\n",{"type":43,"tag":426,"props":2227,"children":2228},{"class":428,"line":1665},[2229,2233,2238,2242,2246,2250,2255,2259],{"type":43,"tag":426,"props":2230,"children":2231},{"style":445},[2232],{"type":49,"value":2193},{"type":43,"tag":426,"props":2234,"children":2235},{"style":2196},[2236],{"type":49,"value":2237},"expiration",{"type":43,"tag":426,"props":2239,"children":2240},{"style":445},[2241],{"type":49,"value":1608},{"type":43,"tag":426,"props":2243,"children":2244},{"style":445},[2245],{"type":49,"value":464},{"type":43,"tag":426,"props":2247,"children":2248},{"style":445},[2249],{"type":49,"value":997},{"type":43,"tag":426,"props":2251,"children":2252},{"style":439},[2253],{"type":49,"value":2254},"90d",{"type":43,"tag":426,"props":2256,"children":2257},{"style":445},[2258],{"type":49,"value":1608},{"type":43,"tag":426,"props":2260,"children":2261},{"style":445},[2262],{"type":49,"value":2225},{"type":43,"tag":426,"props":2264,"children":2265},{"class":428,"line":1684},[2266,2270,2274,2278,2282],{"type":43,"tag":426,"props":2267,"children":2268},{"style":445},[2269],{"type":49,"value":2193},{"type":43,"tag":426,"props":2271,"children":2272},{"style":2196},[2273],{"type":49,"value":1912},{"type":43,"tag":426,"props":2275,"children":2276},{"style":445},[2277],{"type":49,"value":1608},{"type":43,"tag":426,"props":2279,"children":2280},{"style":445},[2281],{"type":49,"value":464},{"type":43,"tag":426,"props":2283,"children":2284},{"style":445},[2285],{"type":49,"value":2286}," {\n",{"type":43,"tag":426,"props":2288,"children":2289},{"class":428,"line":1713},[2290,2295,2300,2304,2308],{"type":43,"tag":426,"props":2291,"children":2292},{"style":445},[2293],{"type":49,"value":2294},"    \"",{"type":43,"tag":426,"props":2296,"children":2297},{"style":433},[2298],{"type":49,"value":2299},"metrics-reader",{"type":43,"tag":426,"props":2301,"children":2302},{"style":445},[2303],{"type":49,"value":1608},{"type":43,"tag":426,"props":2305,"children":2306},{"style":445},[2307],{"type":49,"value":464},{"type":43,"tag":426,"props":2309,"children":2310},{"style":445},[2311],{"type":49,"value":2286},{"type":43,"tag":426,"props":2313,"children":2314},{"class":428,"line":1722},[2315,2319,2325,2329,2333],{"type":43,"tag":426,"props":2316,"children":2317},{"style":445},[2318],{"type":49,"value":1737},{"type":43,"tag":426,"props":2320,"children":2322},{"style":2321},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[2323],{"type":49,"value":2324},"indices",{"type":43,"tag":426,"props":2326,"children":2327},{"style":445},[2328],{"type":49,"value":1608},{"type":43,"tag":426,"props":2330,"children":2331},{"style":445},[2332],{"type":49,"value":464},{"type":43,"tag":426,"props":2334,"children":2335},{"style":445},[2336],{"type":49,"value":2337}," [\n",{"type":43,"tag":426,"props":2339,"children":2340},{"class":428,"line":1731},[2341],{"type":43,"tag":426,"props":2342,"children":2343},{"style":445},[2344],{"type":49,"value":2345},"        {\n",{"type":43,"tag":426,"props":2347,"children":2348},{"class":428,"line":1758},[2349,2354,2360,2364,2368,2373,2377,2381,2385],{"type":43,"tag":426,"props":2350,"children":2351},{"style":445},[2352],{"type":49,"value":2353},"          \"",{"type":43,"tag":426,"props":2355,"children":2357},{"style":2356},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[2358],{"type":49,"value":2359},"names",{"type":43,"tag":426,"props":2361,"children":2362},{"style":445},[2363],{"type":49,"value":1608},{"type":43,"tag":426,"props":2365,"children":2366},{"style":445},[2367],{"type":49,"value":464},{"type":43,"tag":426,"props":2369,"children":2370},{"style":445},[2371],{"type":49,"value":2372}," [",{"type":43,"tag":426,"props":2374,"children":2375},{"style":445},[2376],{"type":49,"value":1608},{"type":43,"tag":426,"props":2378,"children":2379},{"style":439},[2380],{"type":49,"value":2159},{"type":43,"tag":426,"props":2382,"children":2383},{"style":445},[2384],{"type":49,"value":1608},{"type":43,"tag":426,"props":2386,"children":2387},{"style":445},[2388],{"type":49,"value":2389},"],\n",{"type":43,"tag":426,"props":2391,"children":2392},{"class":428,"line":1767},[2393,2397,2402,2406,2410,2414,2418,2423,2427,2432,2436,2441,2445],{"type":43,"tag":426,"props":2394,"children":2395},{"style":445},[2396],{"type":49,"value":2353},{"type":43,"tag":426,"props":2398,"children":2399},{"style":2356},[2400],{"type":49,"value":2401},"privileges",{"type":43,"tag":426,"props":2403,"children":2404},{"style":445},[2405],{"type":49,"value":1608},{"type":43,"tag":426,"props":2407,"children":2408},{"style":445},[2409],{"type":49,"value":464},{"type":43,"tag":426,"props":2411,"children":2412},{"style":445},[2413],{"type":49,"value":2372},{"type":43,"tag":426,"props":2415,"children":2416},{"style":445},[2417],{"type":49,"value":1608},{"type":43,"tag":426,"props":2419,"children":2420},{"style":439},[2421],{"type":49,"value":2422},"read",{"type":43,"tag":426,"props":2424,"children":2425},{"style":445},[2426],{"type":49,"value":1608},{"type":43,"tag":426,"props":2428,"children":2429},{"style":445},[2430],{"type":49,"value":2431},",",{"type":43,"tag":426,"props":2433,"children":2434},{"style":445},[2435],{"type":49,"value":997},{"type":43,"tag":426,"props":2437,"children":2438},{"style":439},[2439],{"type":49,"value":2440},"view_index_metadata",{"type":43,"tag":426,"props":2442,"children":2443},{"style":445},[2444],{"type":49,"value":1608},{"type":43,"tag":426,"props":2446,"children":2447},{"style":445},[2448],{"type":49,"value":2449},"]\n",{"type":43,"tag":426,"props":2451,"children":2452},{"class":428,"line":1776},[2453],{"type":43,"tag":426,"props":2454,"children":2455},{"style":445},[2456],{"type":49,"value":2457},"        }\n",{"type":43,"tag":426,"props":2459,"children":2460},{"class":428,"line":1785},[2461],{"type":43,"tag":426,"props":2462,"children":2463},{"style":445},[2464],{"type":49,"value":2465},"      ]\n",{"type":43,"tag":426,"props":2467,"children":2468},{"class":428,"line":1812},[2469],{"type":43,"tag":426,"props":2470,"children":2471},{"style":445},[2472],{"type":49,"value":1854},{"type":43,"tag":426,"props":2474,"children":2475},{"class":428,"line":1821},[2476],{"type":43,"tag":426,"props":2477,"children":2478},{"style":445},[2479],{"type":49,"value":2480},"  }\n",{"type":43,"tag":426,"props":2482,"children":2483},{"class":428,"line":1830},[2484],{"type":43,"tag":426,"props":2485,"children":2486},{"style":445},[2487],{"type":49,"value":2488},"}\n",{"type":43,"tag":396,"props":2490,"children":2492},{"id":2491},"verify-which-realm-authenticated-the-user",[2493],{"type":49,"value":2494},"Verify which realm authenticated the user",{"type":43,"tag":415,"props":2496,"children":2498},{"className":2164,"code":2497,"language":2166,"meta":420,"style":420},"GET \u002F_security\u002F_authenticate\n",[2499],{"type":43,"tag":138,"props":2500,"children":2501},{"__ignoreMap":420},[2502],{"type":43,"tag":426,"props":2503,"children":2504},{"class":428,"line":429},[2505],{"type":43,"tag":426,"props":2506,"children":2507},{"style":451},[2508],{"type":49,"value":2497},{"type":43,"tag":415,"props":2510,"children":2512},{"className":2164,"code":2511,"language":2166,"meta":420,"style":420},"{\n  \"username\": \"joe\",\n  \"authentication_realm\": { \"name\": \"ldap1\", \"type\": \"ldap\" },\n  \"authentication_type\": \"realm\"\n}\n",[2513],{"type":43,"tag":138,"props":2514,"children":2515},{"__ignoreMap":420},[2516,2523,2559,2651,2683],{"type":43,"tag":426,"props":2517,"children":2518},{"class":428,"line":429},[2519],{"type":43,"tag":426,"props":2520,"children":2521},{"style":445},[2522],{"type":49,"value":1681},{"type":43,"tag":426,"props":2524,"children":2525},{"class":428,"line":852},[2526,2530,2534,2538,2542,2546,2551,2555],{"type":43,"tag":426,"props":2527,"children":2528},{"style":445},[2529],{"type":49,"value":2193},{"type":43,"tag":426,"props":2531,"children":2532},{"style":2196},[2533],{"type":49,"value":1343},{"type":43,"tag":426,"props":2535,"children":2536},{"style":445},[2537],{"type":49,"value":1608},{"type":43,"tag":426,"props":2539,"children":2540},{"style":445},[2541],{"type":49,"value":464},{"type":43,"tag":426,"props":2543,"children":2544},{"style":445},[2545],{"type":49,"value":997},{"type":43,"tag":426,"props":2547,"children":2548},{"style":439},[2549],{"type":49,"value":2550},"joe",{"type":43,"tag":426,"props":2552,"children":2553},{"style":445},[2554],{"type":49,"value":1608},{"type":43,"tag":426,"props":2556,"children":2557},{"style":445},[2558],{"type":49,"value":2225},{"type":43,"tag":426,"props":2560,"children":2561},{"class":428,"line":1639},[2562,2566,2571,2575,2579,2584,2588,2592,2596,2600,2604,2609,2613,2617,2621,2626,2630,2634,2638,2642,2646],{"type":43,"tag":426,"props":2563,"children":2564},{"style":445},[2565],{"type":49,"value":2193},{"type":43,"tag":426,"props":2567,"children":2568},{"style":2196},[2569],{"type":49,"value":2570},"authentication_realm",{"type":43,"tag":426,"props":2572,"children":2573},{"style":445},[2574],{"type":49,"value":1608},{"type":43,"tag":426,"props":2576,"children":2577},{"style":445},[2578],{"type":49,"value":464},{"type":43,"tag":426,"props":2580,"children":2581},{"style":445},[2582],{"type":49,"value":2583}," {",{"type":43,"tag":426,"props":2585,"children":2586},{"style":445},[2587],{"type":49,"value":997},{"type":43,"tag":426,"props":2589,"children":2590},{"style":433},[2591],{"type":49,"value":2199},{"type":43,"tag":426,"props":2593,"children":2594},{"style":445},[2595],{"type":49,"value":1608},{"type":43,"tag":426,"props":2597,"children":2598},{"style":445},[2599],{"type":49,"value":464},{"type":43,"tag":426,"props":2601,"children":2602},{"style":445},[2603],{"type":49,"value":997},{"type":43,"tag":426,"props":2605,"children":2606},{"style":439},[2607],{"type":49,"value":2608},"ldap1",{"type":43,"tag":426,"props":2610,"children":2611},{"style":445},[2612],{"type":49,"value":1608},{"type":43,"tag":426,"props":2614,"children":2615},{"style":445},[2616],{"type":49,"value":2431},{"type":43,"tag":426,"props":2618,"children":2619},{"style":445},[2620],{"type":49,"value":997},{"type":43,"tag":426,"props":2622,"children":2623},{"style":433},[2624],{"type":49,"value":2625},"type",{"type":43,"tag":426,"props":2627,"children":2628},{"style":445},[2629],{"type":49,"value":1608},{"type":43,"tag":426,"props":2631,"children":2632},{"style":445},[2633],{"type":49,"value":464},{"type":43,"tag":426,"props":2635,"children":2636},{"style":445},[2637],{"type":49,"value":997},{"type":43,"tag":426,"props":2639,"children":2640},{"style":439},[2641],{"type":49,"value":597},{"type":43,"tag":426,"props":2643,"children":2644},{"style":445},[2645],{"type":49,"value":1608},{"type":43,"tag":426,"props":2647,"children":2648},{"style":445},[2649],{"type":49,"value":2650}," },\n",{"type":43,"tag":426,"props":2652,"children":2653},{"class":428,"line":1665},[2654,2658,2662,2666,2670,2674,2679],{"type":43,"tag":426,"props":2655,"children":2656},{"style":445},[2657],{"type":49,"value":2193},{"type":43,"tag":426,"props":2659,"children":2660},{"style":2196},[2661],{"type":49,"value":1540},{"type":43,"tag":426,"props":2663,"children":2664},{"style":445},[2665],{"type":49,"value":1608},{"type":43,"tag":426,"props":2667,"children":2668},{"style":445},[2669],{"type":49,"value":464},{"type":43,"tag":426,"props":2671,"children":2672},{"style":445},[2673],{"type":49,"value":997},{"type":43,"tag":426,"props":2675,"children":2676},{"style":439},[2677],{"type":49,"value":2678},"realm",{"type":43,"tag":426,"props":2680,"children":2681},{"style":445},[2682],{"type":49,"value":501},{"type":43,"tag":426,"props":2684,"children":2685},{"class":428,"line":1684},[2686],{"type":43,"tag":426,"props":2687,"children":2688},{"style":445},[2689],{"type":49,"value":2488},{"type":43,"tag":396,"props":2691,"children":2693},{"id":2692},"authenticate-with-a-jwt-bearer-token",[2694],{"type":49,"value":2695},"Authenticate with a JWT bearer token",{"type":43,"tag":415,"props":2697,"children":2699},{"className":417,"code":2698,"language":419,"meta":420,"style":420},"curl -H \"Authorization: Bearer ${JWT_TOKEN}\" \"https:\u002F\u002Fmy-cluster:9200\u002F_security\u002F_authenticate\"\n",[2700],{"type":43,"tag":138,"props":2701,"children":2702},{"__ignoreMap":420},[2703],{"type":43,"tag":426,"props":2704,"children":2705},{"class":428,"line":429},[2706,2710,2714,2718,2722,2726,2730,2734,2738,2743],{"type":43,"tag":426,"props":2707,"children":2708},{"style":433},[2709],{"type":49,"value":436},{"type":43,"tag":426,"props":2711,"children":2712},{"style":439},[2713],{"type":49,"value":992},{"type":43,"tag":426,"props":2715,"children":2716},{"style":445},[2717],{"type":49,"value":997},{"type":43,"tag":426,"props":2719,"children":2720},{"style":439},[2721],{"type":49,"value":1002},{"type":43,"tag":426,"props":2723,"children":2724},{"style":445},[2725],{"type":49,"value":469},{"type":43,"tag":426,"props":2727,"children":2728},{"style":451},[2729],{"type":49,"value":1011},{"type":43,"tag":426,"props":2731,"children":2732},{"style":445},[2733],{"type":49,"value":478},{"type":43,"tag":426,"props":2735,"children":2736},{"style":445},[2737],{"type":49,"value":997},{"type":43,"tag":426,"props":2739,"children":2740},{"style":439},[2741],{"type":49,"value":2742},"https:\u002F\u002Fmy-cluster:9200\u002F_security\u002F_authenticate",{"type":43,"tag":426,"props":2744,"children":2745},{"style":445},[2746],{"type":49,"value":501},{"type":43,"tag":52,"props":2748,"children":2749},{},[2750,2752,2757,2759,2765],{"type":49,"value":2751},"Confirm the response shows ",{"type":43,"tag":138,"props":2753,"children":2755},{"className":2754},[],[2756],{"type":49,"value":1358},{"type":49,"value":2758}," as ",{"type":43,"tag":138,"props":2760,"children":2762},{"className":2761},[],[2763],{"type":49,"value":2764},"\"jwt\"",{"type":49,"value":82},{"type":43,"tag":106,"props":2767,"children":2769},{"id":2768},"guidelines",[2770],{"type":49,"value":2771},"Guidelines",{"type":43,"tag":396,"props":2773,"children":2775},{"id":2774},"choosing-an-authentication-method",[2776],{"type":49,"value":2777},"Choosing an authentication method",{"type":43,"tag":268,"props":2779,"children":2780},{},[2781,2802],{"type":43,"tag":272,"props":2782,"children":2783},{},[2784],{"type":43,"tag":276,"props":2785,"children":2786},{},[2787,2792,2797],{"type":43,"tag":280,"props":2788,"children":2789},{},[2790],{"type":49,"value":2791},"Method",{"type":43,"tag":280,"props":2793,"children":2794},{},[2795],{"type":49,"value":2796},"Best for",{"type":43,"tag":280,"props":2798,"children":2799},{},[2800],{"type":49,"value":2801},"Trade-offs",{"type":43,"tag":291,"props":2803,"children":2804},{},[2805,2823,2841,2859,2877,2895,2912,2929,2946],{"type":43,"tag":276,"props":2806,"children":2807},{},[2808,2813,2818],{"type":43,"tag":298,"props":2809,"children":2810},{},[2811],{"type":49,"value":2812},"Native user",{"type":43,"tag":298,"props":2814,"children":2815},{},[2816],{"type":49,"value":2817},"Interactive use, simple setups",{"type":43,"tag":298,"props":2819,"children":2820},{},[2821],{"type":49,"value":2822},"Password must be stored or prompted",{"type":43,"tag":276,"props":2824,"children":2825},{},[2826,2831,2836],{"type":43,"tag":298,"props":2827,"children":2828},{},[2829],{"type":49,"value":2830},"File user",{"type":43,"tag":298,"props":2832,"children":2833},{},[2834],{"type":49,"value":2835},"Disaster recovery, bootstrap",{"type":43,"tag":298,"props":2837,"children":2838},{},[2839],{"type":49,"value":2840},"Must be configured on every node",{"type":43,"tag":276,"props":2842,"children":2843},{},[2844,2849,2854],{"type":43,"tag":298,"props":2845,"children":2846},{},[2847],{"type":49,"value":2848},"API key",{"type":43,"tag":298,"props":2850,"children":2851},{},[2852],{"type":49,"value":2853},"Programmatic access, CI\u002FCD, scoped access",{"type":43,"tag":298,"props":2855,"children":2856},{},[2857],{"type":49,"value":2858},"Cannot be retrieved after creation",{"type":43,"tag":276,"props":2860,"children":2861},{},[2862,2867,2872],{"type":43,"tag":298,"props":2863,"children":2864},{},[2865],{"type":49,"value":2866},"LDAP \u002F AD",{"type":43,"tag":298,"props":2868,"children":2869},{},[2870],{"type":49,"value":2871},"Enterprise directory integration",{"type":43,"tag":298,"props":2873,"children":2874},{},[2875],{"type":49,"value":2876},"Requires network access to directory server",{"type":43,"tag":276,"props":2878,"children":2879},{},[2880,2885,2890],{"type":43,"tag":298,"props":2881,"children":2882},{},[2883],{"type":49,"value":2884},"PKI certificate",{"type":43,"tag":298,"props":2886,"children":2887},{},[2888],{"type":49,"value":2889},"Service-to-service, mutual TLS environments",{"type":43,"tag":298,"props":2891,"children":2892},{},[2893],{"type":49,"value":2894},"Requires PKI infrastructure and PKI realm",{"type":43,"tag":276,"props":2896,"children":2897},{},[2898,2902,2907],{"type":43,"tag":298,"props":2899,"children":2900},{},[2901],{"type":49,"value":880},{"type":43,"tag":298,"props":2903,"children":2904},{},[2905],{"type":49,"value":2906},"Kibana SSO via enterprise IdP",{"type":43,"tag":298,"props":2908,"children":2909},{},[2910],{"type":49,"value":2911},"Browser-only; not for REST clients",{"type":43,"tag":276,"props":2913,"children":2914},{},[2915,2920,2925],{"type":43,"tag":298,"props":2916,"children":2917},{},[2918],{"type":49,"value":2919},"OIDC",{"type":43,"tag":298,"props":2921,"children":2922},{},[2923],{"type":49,"value":2924},"Kibana SSO via OpenID Connect provider",{"type":43,"tag":298,"props":2926,"children":2927},{},[2928],{"type":49,"value":2911},{"type":43,"tag":276,"props":2930,"children":2931},{},[2932,2936,2941],{"type":43,"tag":298,"props":2933,"children":2934},{},[2935],{"type":49,"value":1514},{"type":43,"tag":298,"props":2937,"children":2938},{},[2939],{"type":49,"value":2940},"Token-based service and user authentication",{"type":43,"tag":298,"props":2942,"children":2943},{},[2944],{"type":49,"value":2945},"Requires external token issuer and realm config",{"type":43,"tag":276,"props":2947,"children":2948},{},[2949,2953,2958],{"type":43,"tag":298,"props":2950,"children":2951},{},[2952],{"type":49,"value":1060},{"type":43,"tag":298,"props":2954,"children":2955},{},[2956],{"type":49,"value":2957},"Windows\u002Fenterprise Kerberos environments",{"type":43,"tag":298,"props":2959,"children":2960},{},[2961],{"type":49,"value":2962},"Requires KDC, DNS, time sync infrastructure",{"type":43,"tag":52,"props":2964,"children":2965},{},[2966],{"type":49,"value":2967},"Prefer API keys for automated workflows — they support fine-grained scoping and independent expiration. For Kibana SSO,\nuse SAML or OIDC. For enterprise directory integration, use LDAP or AD with role mappings (see elasticsearch-authz).",{"type":43,"tag":396,"props":2969,"children":2971},{"id":2970},"avoid-superuser-credentials",[2972],{"type":49,"value":2973},"Avoid superuser credentials",{"type":43,"tag":52,"props":2975,"children":2976},{},[2977,2979,2984,2986,2992,2994,2999],{"type":49,"value":2978},"Never use the built-in ",{"type":43,"tag":138,"props":2980,"children":2982},{"className":2981},[],[2983],{"type":49,"value":8},{"type":49,"value":2985}," superuser or any ",{"type":43,"tag":138,"props":2987,"children":2989},{"className":2988},[],[2990],{"type":49,"value":2991},"superuser",{"type":49,"value":2993},"-role account for day-to-day operations, automation, or\napplication access. Instead, create a dedicated user or API key with only the privileges the task requires. The\n",{"type":43,"tag":138,"props":2995,"children":2997},{"className":2996},[],[2998],{"type":49,"value":8},{"type":49,"value":3000}," user should be reserved for initial cluster setup and emergency recovery only.",{"type":43,"tag":396,"props":3002,"children":3003},{"id":14},[3004],{"type":49,"value":13},{"type":43,"tag":113,"props":3006,"children":3007},{},[3008,3026,3038,3050,3055,3060,3073,3093],{"type":43,"tag":117,"props":3009,"children":3010},{},[3011,3013,3017,3019,3024],{"type":49,"value":3012},"An API key ",{"type":43,"tag":63,"props":3014,"children":3015},{},[3016],{"type":49,"value":1932},{"type":49,"value":3018}," create another API key with privileges. Use user credentials or ",{"type":43,"tag":138,"props":3020,"children":3022},{"className":3021},[],[3023],{"type":49,"value":1940},{"type":49,"value":3025},"\nfor programmatic key creation.",{"type":43,"tag":117,"props":3027,"children":3028},{},[3029,3031,3036],{"type":49,"value":3030},"Always set ",{"type":43,"tag":138,"props":3032,"children":3034},{"className":3033},[],[3035],{"type":49,"value":2237},{"type":49,"value":3037}," on API keys. Avoid indefinite keys in production.",{"type":43,"tag":117,"props":3039,"children":3040},{},[3041,3043,3048],{"type":49,"value":3042},"Scope API keys via ",{"type":43,"tag":138,"props":3044,"children":3046},{"className":3045},[],[3047],{"type":49,"value":1912},{"type":49,"value":3049},". Never create unscoped keys for automated systems.",{"type":43,"tag":117,"props":3051,"children":3052},{},[3053],{"type":49,"value":3054},"Never receive, echo, or log passwords, API keys, tokens, or any credentials in the chat. Instruct the user to manage\nsecrets in their terminal, environment variables, or files directly.",{"type":43,"tag":117,"props":3056,"children":3057},{},[3058],{"type":49,"value":3059},"Never store secrets in code, scripts, or version control. Load from environment variables.",{"type":43,"tag":117,"props":3061,"children":3062},{},[3063,3065,3071],{"type":49,"value":3064},"Use ",{"type":43,"tag":138,"props":3066,"children":3068},{"className":3067},[],[3069],{"type":49,"value":3070},"GET \u002F_security\u002F_authenticate",{"type":49,"value":3072}," to verify credentials before running management operations.",{"type":43,"tag":117,"props":3074,"children":3075},{},[3076,3078,3084,3086,3092],{"type":49,"value":3077},"When generating passwords for native users, use at least 16 characters mixing uppercase, lowercase, digits, and\nsymbols. Never use placeholder values like ",{"type":43,"tag":138,"props":3079,"children":3081},{"className":3080},[],[3082],{"type":49,"value":3083},"changeme",{"type":49,"value":3085}," or ",{"type":43,"tag":138,"props":3087,"children":3089},{"className":3088},[],[3090],{"type":49,"value":3091},"password123",{"type":49,"value":82},{"type":43,"tag":117,"props":3094,"children":3095},{},[3096],{"type":49,"value":3097},"SAML and OIDC are for browser-based SSO only. Always configure a companion realm (native, file, or API keys) for REST\nAPI access alongside them.",{"type":43,"tag":106,"props":3099,"children":3101},{"id":3100},"deployment-compatibility",[3102],{"type":49,"value":102},{"type":43,"tag":52,"props":3104,"children":3105},{},[3106,3108,3113,3115,3120,3122,3127],{"type":49,"value":3107},"Not all authentication realms are available on every deployment type. ",{"type":43,"tag":63,"props":3109,"children":3110},{},[3111],{"type":49,"value":3112},"Self-managed",{"type":49,"value":3114}," clusters support all realms.\n",{"type":43,"tag":63,"props":3116,"children":3117},{},[3118],{"type":49,"value":3119},"Elastic Cloud Hosted (ECH)",{"type":49,"value":3121}," is managed by Elastic with no node-level access. ",{"type":43,"tag":63,"props":3123,"children":3124},{},[3125],{"type":49,"value":3126},"Serverless",{"type":49,"value":3128}," is fully managed SaaS.",{"type":43,"tag":268,"props":3130,"children":3131},{},[3132,3155],{"type":43,"tag":272,"props":3133,"children":3134},{},[3135],{"type":43,"tag":276,"props":3136,"children":3137},{},[3138,3142,3146,3151],{"type":43,"tag":280,"props":3139,"children":3140},{},[3141],{"type":49,"value":1382},{"type":43,"tag":280,"props":3143,"children":3144},{},[3145],{"type":49,"value":3112},{"type":43,"tag":280,"props":3147,"children":3148},{},[3149],{"type":49,"value":3150},"ECH",{"type":43,"tag":280,"props":3152,"children":3153},{},[3154],{"type":49,"value":3126},{"type":43,"tag":291,"props":3156,"children":3157},{},[3158,3179,3198,3217,3236,3256,3277,3296,3315,3334],{"type":43,"tag":276,"props":3159,"children":3160},{},[3161,3165,3170,3174],{"type":43,"tag":298,"props":3162,"children":3163},{},[3164],{"type":49,"value":1402},{"type":43,"tag":298,"props":3166,"children":3167},{},[3168],{"type":49,"value":3169},"Yes",{"type":43,"tag":298,"props":3171,"children":3172},{},[3173],{"type":49,"value":3169},{"type":43,"tag":298,"props":3175,"children":3176},{},[3177],{"type":49,"value":3178},"Not available",{"type":43,"tag":276,"props":3180,"children":3181},{},[3182,3186,3190,3194],{"type":43,"tag":298,"props":3183,"children":3184},{},[3185],{"type":49,"value":507},{"type":43,"tag":298,"props":3187,"children":3188},{},[3189],{"type":49,"value":3169},{"type":43,"tag":298,"props":3191,"children":3192},{},[3193],{"type":49,"value":3178},{"type":43,"tag":298,"props":3195,"children":3196},{},[3197],{"type":49,"value":3178},{"type":43,"tag":276,"props":3199,"children":3200},{},[3201,3205,3209,3213],{"type":43,"tag":298,"props":3202,"children":3203},{},[3204],{"type":49,"value":600},{"type":43,"tag":298,"props":3206,"children":3207},{},[3208],{"type":49,"value":3169},{"type":43,"tag":298,"props":3210,"children":3211},{},[3212],{"type":49,"value":3178},{"type":43,"tag":298,"props":3214,"children":3215},{},[3216],{"type":49,"value":3178},{"type":43,"tag":276,"props":3218,"children":3219},{},[3220,3224,3228,3232],{"type":43,"tag":298,"props":3221,"children":3222},{},[3223],{"type":49,"value":684},{"type":43,"tag":298,"props":3225,"children":3226},{},[3227],{"type":49,"value":3169},{"type":43,"tag":298,"props":3229,"children":3230},{},[3231],{"type":49,"value":3178},{"type":43,"tag":298,"props":3233,"children":3234},{},[3235],{"type":49,"value":3178},{"type":43,"tag":276,"props":3237,"children":3238},{},[3239,3243,3247,3252],{"type":43,"tag":298,"props":3240,"children":3241},{},[3242],{"type":49,"value":1465},{"type":43,"tag":298,"props":3244,"children":3245},{},[3246],{"type":49,"value":3169},{"type":43,"tag":298,"props":3248,"children":3249},{},[3250],{"type":49,"value":3251},"Limited",{"type":43,"tag":298,"props":3253,"children":3254},{},[3255],{"type":49,"value":3178},{"type":43,"tag":276,"props":3257,"children":3258},{},[3259,3263,3267,3272],{"type":43,"tag":298,"props":3260,"children":3261},{},[3262],{"type":49,"value":880},{"type":43,"tag":298,"props":3264,"children":3265},{},[3266],{"type":49,"value":3169},{"type":43,"tag":298,"props":3268,"children":3269},{},[3270],{"type":49,"value":3271},"Yes (deployment config)",{"type":43,"tag":298,"props":3273,"children":3274},{},[3275],{"type":49,"value":3276},"Organization-level",{"type":43,"tag":276,"props":3278,"children":3279},{},[3280,3284,3288,3292],{"type":43,"tag":298,"props":3281,"children":3282},{},[3283],{"type":49,"value":2919},{"type":43,"tag":298,"props":3285,"children":3286},{},[3287],{"type":49,"value":3169},{"type":43,"tag":298,"props":3289,"children":3290},{},[3291],{"type":49,"value":3271},{"type":43,"tag":298,"props":3293,"children":3294},{},[3295],{"type":49,"value":3178},{"type":43,"tag":276,"props":3297,"children":3298},{},[3299,3303,3307,3311],{"type":43,"tag":298,"props":3300,"children":3301},{},[3302],{"type":49,"value":1514},{"type":43,"tag":298,"props":3304,"children":3305},{},[3306],{"type":49,"value":3169},{"type":43,"tag":298,"props":3308,"children":3309},{},[3310],{"type":49,"value":3271},{"type":43,"tag":298,"props":3312,"children":3313},{},[3314],{"type":49,"value":3178},{"type":43,"tag":276,"props":3316,"children":3317},{},[3318,3322,3326,3330],{"type":43,"tag":298,"props":3319,"children":3320},{},[3321],{"type":49,"value":1060},{"type":43,"tag":298,"props":3323,"children":3324},{},[3325],{"type":49,"value":3169},{"type":43,"tag":298,"props":3327,"children":3328},{},[3329],{"type":49,"value":3178},{"type":43,"tag":298,"props":3331,"children":3332},{},[3333],{"type":49,"value":3178},{"type":43,"tag":276,"props":3335,"children":3336},{},[3337,3341,3345,3349],{"type":43,"tag":298,"props":3338,"children":3339},{},[3340],{"type":49,"value":1169},{"type":43,"tag":298,"props":3342,"children":3343},{},[3344],{"type":49,"value":3169},{"type":43,"tag":298,"props":3346,"children":3347},{},[3348],{"type":49,"value":3169},{"type":43,"tag":298,"props":3350,"children":3351},{},[3352],{"type":49,"value":3169},{"type":43,"tag":52,"props":3354,"children":3355},{},[3356],{"type":43,"tag":63,"props":3357,"children":3358},{},[3359],{"type":49,"value":3360},"ECH notes:",{"type":43,"tag":113,"props":3362,"children":3363},{},[3364,3376,3381,3386],{"type":43,"tag":117,"props":3365,"children":3366},{},[3367,3369,3374],{"type":49,"value":3368},"No node access, so the file realm and ",{"type":43,"tag":138,"props":3370,"children":3372},{"className":3371},[],[3373],{"type":49,"value":518},{"type":49,"value":3375}," CLI are not available.",{"type":43,"tag":117,"props":3377,"children":3378},{},[3379],{"type":49,"value":3380},"LDAP, Active Directory, and Kerberos cannot be configured on ECH.",{"type":43,"tag":117,"props":3382,"children":3383},{},[3384],{"type":49,"value":3385},"SAML, OIDC, and JWT are configurable via the Cloud deployment settings UI.",{"type":43,"tag":117,"props":3387,"children":3388},{},[3389,3390,3395],{"type":49,"value":1140},{"type":43,"tag":138,"props":3391,"children":3393},{"className":3392},[],[3394],{"type":49,"value":8},{"type":49,"value":3396}," superuser is available but should still be avoided for routine use.",{"type":43,"tag":52,"props":3398,"children":3399},{},[3400],{"type":43,"tag":63,"props":3401,"children":3402},{},[3403],{"type":49,"value":3404},"Serverless notes:",{"type":43,"tag":113,"props":3406,"children":3407},{},[3408,3413,3418],{"type":43,"tag":117,"props":3409,"children":3410},{},[3411],{"type":49,"value":3412},"API keys are the primary authentication method.",{"type":43,"tag":117,"props":3414,"children":3415},{},[3416],{"type":49,"value":3417},"Native users do not exist — users are managed at the Elastic Cloud organization level.",{"type":43,"tag":117,"props":3419,"children":3420},{},[3421],{"type":49,"value":3422},"SAML SSO is configured at the organization level, not per project.",{"type":43,"tag":3424,"props":3425,"children":3426},"style",{},[3427],{"type":49,"value":3428},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3430,"total":3515},[3431,3448,3460,3470,3483,3493,3508],{"slug":3432,"name":3432,"fn":3433,"description":3434,"org":3435,"tags":3436,"stars":23,"repoUrl":24,"updatedAt":3447},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3437,3440,3441,3444],{"name":3438,"slug":3439,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3442,"slug":3443,"type":15},"Operations","operations",{"name":3445,"slug":3446,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":3449,"name":3449,"fn":3450,"description":3451,"org":3452,"tags":3453,"stars":23,"repoUrl":24,"updatedAt":3459},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3454,3455,3458],{"name":3438,"slug":3439,"type":15},{"name":3456,"slug":3457,"type":15},"Deployment","deployment",{"name":21,"slug":22,"type":15},"2026-07-12T07:46:42.353362",{"slug":3461,"name":3461,"fn":3462,"description":3463,"org":3464,"tags":3465,"stars":23,"repoUrl":24,"updatedAt":3469},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3466,3467,3468],{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},{"name":3442,"slug":3443,"type":15},"2026-07-12T07:46:41.097412",{"slug":3471,"name":3471,"fn":3472,"description":3473,"org":3474,"tags":3475,"stars":23,"repoUrl":24,"updatedAt":3482},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3476,3477,3478,3481],{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},{"name":3479,"slug":3480,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":3484,"name":3484,"fn":3485,"description":3486,"org":3487,"tags":3488,"stars":23,"repoUrl":24,"updatedAt":3492},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3489,3490,3491],{"name":18,"slug":19,"type":15},{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},"2026-07-12T07:46:39.783105",{"slug":3494,"name":3494,"fn":3495,"description":3496,"org":3497,"tags":3498,"stars":23,"repoUrl":24,"updatedAt":3507},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3499,3502,3503,3506],{"name":3500,"slug":3501,"type":15},"Audit","audit",{"name":21,"slug":22,"type":15},{"name":3504,"slug":3505,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":4,"name":4,"fn":5,"description":6,"org":3509,"tags":3510,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3511,3512,3513,3514],{"name":18,"slug":19,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},35,{"items":3517,"total":3638},[3518,3537,3554,3567,3574,3580,3586,3593,3599,3606,3613,3625],{"slug":3519,"name":3519,"fn":3520,"description":3521,"org":3522,"tags":3523,"stars":3534,"repoUrl":3535,"updatedAt":3536},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3524,3527,3530,3531],{"name":3525,"slug":3526,"type":15},"Analytics","analytics",{"name":3528,"slug":3529,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3532,"slug":3533,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3538,"name":3538,"fn":3539,"description":3540,"org":3541,"tags":3542,"stars":3534,"repoUrl":3535,"updatedAt":3553},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3543,3546,3547,3550],{"name":3544,"slug":3545,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3548,"slug":3549,"type":15},"Engineering","engineering",{"name":3551,"slug":3552,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3555,"name":3555,"fn":3556,"description":3557,"org":3558,"tags":3559,"stars":3534,"repoUrl":3535,"updatedAt":3566},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3560,3561,3562,3563],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":3532,"slug":3533,"type":15},{"name":3564,"slug":3565,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3432,"name":3432,"fn":3433,"description":3434,"org":3568,"tags":3569,"stars":23,"repoUrl":24,"updatedAt":3447},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3570,3571,3572,3573],{"name":3438,"slug":3439,"type":15},{"name":9,"slug":8,"type":15},{"name":3442,"slug":3443,"type":15},{"name":3445,"slug":3446,"type":15},{"slug":3449,"name":3449,"fn":3450,"description":3451,"org":3575,"tags":3576,"stars":23,"repoUrl":24,"updatedAt":3459},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3577,3578,3579],{"name":3438,"slug":3439,"type":15},{"name":3456,"slug":3457,"type":15},{"name":21,"slug":22,"type":15},{"slug":3461,"name":3461,"fn":3462,"description":3463,"org":3581,"tags":3582,"stars":23,"repoUrl":24,"updatedAt":3469},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3583,3584,3585],{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},{"name":3442,"slug":3443,"type":15},{"slug":3471,"name":3471,"fn":3472,"description":3473,"org":3587,"tags":3588,"stars":23,"repoUrl":24,"updatedAt":3482},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3589,3590,3591,3592],{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},{"name":3479,"slug":3480,"type":15},{"name":13,"slug":14,"type":15},{"slug":3484,"name":3484,"fn":3485,"description":3486,"org":3594,"tags":3595,"stars":23,"repoUrl":24,"updatedAt":3492},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3596,3597,3598],{"name":18,"slug":19,"type":15},{"name":3438,"slug":3439,"type":15},{"name":21,"slug":22,"type":15},{"slug":3494,"name":3494,"fn":3495,"description":3496,"org":3600,"tags":3601,"stars":23,"repoUrl":24,"updatedAt":3507},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3602,3603,3604,3605],{"name":3500,"slug":3501,"type":15},{"name":21,"slug":22,"type":15},{"name":3504,"slug":3505,"type":15},{"name":13,"slug":14,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":3607,"tags":3608,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3609,3610,3611,3612],{"name":18,"slug":19,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"slug":67,"name":67,"fn":3614,"description":3615,"org":3616,"tags":3617,"stars":23,"repoUrl":24,"updatedAt":3624},"manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3618,3619,3620,3623],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":3621,"slug":3622,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":3626,"name":3626,"fn":3627,"description":3628,"org":3629,"tags":3630,"stars":23,"repoUrl":24,"updatedAt":3637},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3631,3632,3633,3634],{"name":3525,"slug":3526,"type":15},{"name":3528,"slug":3529,"type":15},{"name":21,"slug":22,"type":15},{"name":3635,"slug":3636,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]