Get service accounts API
editGet service accounts API
editRetrieves information about service accounts.
Currently, only the elastic/fleet-server
service account is available.
Request
editGET /_security/service
GET /_security/service/<namespace>
GET /_security/service/<namespace>/<service>
Prerequisites
edit-
To use this API, you must have at least the
manage_service_account
cluster privilege.
Description
editIn production mode, service accounts require TLS on the HTTP interface. A runtime check prevents you from invoking any related APIs or authenticating with a service account token unless TLS is enabled on the HTTP interface. See encrypt HTTP client communications for Elasticsearch.
Path parameters
edit-
namespace
-
(Optional, string) Name of the namespace. Omit this parameter to retrieve information about all service accounts. If you omit this parameter, you must also omit the
service
parameter. -
service
-
(Optional, string) Name of the service name. Omit this parameter to
retrieve information about all service accounts that belong to the specified
namespace
.
Response body
editA successful call returns a JSON object of service accounts. The API returns an empty object if no service account is found.
Examples
editTo following request retrieves a service account for the elastic/fleet-server
service account:
GET /_security/service/elastic/fleet-server
{ "elastic/fleet-server": { "role_descriptor": { "cluster": [ "monitor", "manage_own_api_key" ], "indices": [ { "names": [ "logs-*", "metrics-*", "traces-*", "synthetics-*", ".logs-endpoint.diagnostic.collection-*" ], "privileges": [ "write", "create_index", "auto_configure" ], "allow_restricted_indices": false }, { "names": [ ".fleet-*" ], "privileges": [ "read", "write", "monitor", "create_index", "auto_configure" ], "allow_restricted_indices": false } ], "applications": [], "run_as": [], "metadata": {}, "transient_metadata": { "enabled": true } } } }
Omit the namespace
and service
to retrieve all service accounts:
GET /_security/service