Package co.elastic.clients.elasticsearch.security

Class ElasticsearchSecurityClient

java.lang.Object

co.elastic.clients.ApiClient<ElasticsearchTransport,ElasticsearchSecurityClient>

co.elastic.clients.elasticsearch.security.ElasticsearchSecurityClient

All Implemented Interfaces:

Closeable, AutoCloseable

public class ElasticsearchSecurityClient
extends ApiClient<ElasticsearchTransport,ElasticsearchSecurityClient>

Client for the security namespace.

Field Summary

Fields inherited from class co.elastic.clients.ApiClient

transport, transportOptions

Constructor Summary

Constructors

Constructor	Description
ElasticsearchSecurityClient(ElasticsearchTransport transport)
ElasticsearchSecurityClient(ElasticsearchTransport transport, TransportOptions transportOptions)

Method Summary

Modifier and Type	Method	Description
ActivateUserProfileResponse	activateUserProfile(ActivateUserProfileRequest request)	Activate a user profile.
final ActivateUserProfileResponse	activateUserProfile(Function<ActivateUserProfileRequest.Builder,ObjectBuilder<ActivateUserProfileRequest>> fn)	Activate a user profile.
AuthenticateResponse	authenticate()	Authenticate a user.
BulkDeleteRoleResponse	bulkDeleteRole(BulkDeleteRoleRequest request)	Bulk delete roles.
final BulkDeleteRoleResponse	bulkDeleteRole(Function<BulkDeleteRoleRequest.Builder,ObjectBuilder<BulkDeleteRoleRequest>> fn)	Bulk delete roles.
BulkPutRoleResponse	bulkPutRole(BulkPutRoleRequest request)	Bulk create or update roles.
final BulkPutRoleResponse	bulkPutRole(Function<BulkPutRoleRequest.Builder,ObjectBuilder<BulkPutRoleRequest>> fn)	Bulk create or update roles.
BulkUpdateApiKeysResponse	bulkUpdateApiKeys(BulkUpdateApiKeysRequest request)	Bulk update API keys.
final BulkUpdateApiKeysResponse	bulkUpdateApiKeys(Function<BulkUpdateApiKeysRequest.Builder,ObjectBuilder<BulkUpdateApiKeysRequest>> fn)	Bulk update API keys.
ChangePasswordResponse	changePassword()	Change passwords.
ChangePasswordResponse	changePassword(ChangePasswordRequest request)	Change passwords.
final ChangePasswordResponse	changePassword(Function<ChangePasswordRequest.Builder,ObjectBuilder<ChangePasswordRequest>> fn)	Change passwords.
ClearApiKeyCacheResponse	clearApiKeyCache(ClearApiKeyCacheRequest request)	Clear the API key cache.
final ClearApiKeyCacheResponse	clearApiKeyCache(Function<ClearApiKeyCacheRequest.Builder,ObjectBuilder<ClearApiKeyCacheRequest>> fn)	Clear the API key cache.
ClearCachedPrivilegesResponse	clearCachedPrivileges(ClearCachedPrivilegesRequest request)	Clear the privileges cache.
final ClearCachedPrivilegesResponse	clearCachedPrivileges(Function<ClearCachedPrivilegesRequest.Builder,ObjectBuilder<ClearCachedPrivilegesRequest>> fn)	Clear the privileges cache.
ClearCachedRealmsResponse	clearCachedRealms(ClearCachedRealmsRequest request)	Clear the user cache.
final ClearCachedRealmsResponse	clearCachedRealms(Function<ClearCachedRealmsRequest.Builder,ObjectBuilder<ClearCachedRealmsRequest>> fn)	Clear the user cache.
ClearCachedRolesResponse	clearCachedRoles(ClearCachedRolesRequest request)	Clear the roles cache.
final ClearCachedRolesResponse	clearCachedRoles(Function<ClearCachedRolesRequest.Builder,ObjectBuilder<ClearCachedRolesRequest>> fn)	Clear the roles cache.
ClearCachedServiceTokensResponse	clearCachedServiceTokens(ClearCachedServiceTokensRequest request)	Clear service account token caches.
final ClearCachedServiceTokensResponse	clearCachedServiceTokens(Function<ClearCachedServiceTokensRequest.Builder,ObjectBuilder<ClearCachedServiceTokensRequest>> fn)	Clear service account token caches.
CreateApiKeyResponse	createApiKey()	Create an API key.
CreateApiKeyResponse	createApiKey(CreateApiKeyRequest request)	Create an API key.
final CreateApiKeyResponse	createApiKey(Function<CreateApiKeyRequest.Builder,ObjectBuilder<CreateApiKeyRequest>> fn)	Create an API key.
CreateCrossClusterApiKeyResponse	createCrossClusterApiKey(CreateCrossClusterApiKeyRequest request)	Create a cross-cluster API key.
final CreateCrossClusterApiKeyResponse	createCrossClusterApiKey(Function<CreateCrossClusterApiKeyRequest.Builder,ObjectBuilder<CreateCrossClusterApiKeyRequest>> fn)	Create a cross-cluster API key.
CreateServiceTokenResponse	createServiceToken(CreateServiceTokenRequest request)	Create a service account token.
final CreateServiceTokenResponse	createServiceToken(Function<CreateServiceTokenRequest.Builder,ObjectBuilder<CreateServiceTokenRequest>> fn)	Create a service account token.
DelegatePkiResponse	delegatePki(DelegatePkiRequest request)	Delegate PKI authentication.
final DelegatePkiResponse	delegatePki(Function<DelegatePkiRequest.Builder,ObjectBuilder<DelegatePkiRequest>> fn)	Delegate PKI authentication.
DeletePrivilegesResponse	deletePrivileges(DeletePrivilegesRequest request)	Delete application privileges.
final DeletePrivilegesResponse	deletePrivileges(Function<DeletePrivilegesRequest.Builder,ObjectBuilder<DeletePrivilegesRequest>> fn)	Delete application privileges.
DeleteRoleResponse	deleteRole(DeleteRoleRequest request)	Delete roles.
final DeleteRoleResponse	deleteRole(Function<DeleteRoleRequest.Builder,ObjectBuilder<DeleteRoleRequest>> fn)	Delete roles.
DeleteRoleMappingResponse	deleteRoleMapping(DeleteRoleMappingRequest request)	Delete role mappings.
final DeleteRoleMappingResponse	deleteRoleMapping(Function<DeleteRoleMappingRequest.Builder,ObjectBuilder<DeleteRoleMappingRequest>> fn)	Delete role mappings.
DeleteServiceTokenResponse	deleteServiceToken(DeleteServiceTokenRequest request)	Delete service account tokens.
final DeleteServiceTokenResponse	deleteServiceToken(Function<DeleteServiceTokenRequest.Builder,ObjectBuilder<DeleteServiceTokenRequest>> fn)	Delete service account tokens.
DeleteUserResponse	deleteUser(DeleteUserRequest request)	Delete users.
final DeleteUserResponse	deleteUser(Function<DeleteUserRequest.Builder,ObjectBuilder<DeleteUserRequest>> fn)	Delete users.
DisableUserResponse	disableUser(DisableUserRequest request)	Disable users.
final DisableUserResponse	disableUser(Function<DisableUserRequest.Builder,ObjectBuilder<DisableUserRequest>> fn)	Disable users.
DisableUserProfileResponse	disableUserProfile(DisableUserProfileRequest request)	Disable a user profile.
final DisableUserProfileResponse	disableUserProfile(Function<DisableUserProfileRequest.Builder,ObjectBuilder<DisableUserProfileRequest>> fn)	Disable a user profile.
EnableUserResponse	enableUser(EnableUserRequest request)	Enable users.
final EnableUserResponse	enableUser(Function<EnableUserRequest.Builder,ObjectBuilder<EnableUserRequest>> fn)	Enable users.
EnableUserProfileResponse	enableUserProfile(EnableUserProfileRequest request)	Enable a user profile.
final EnableUserProfileResponse	enableUserProfile(Function<EnableUserProfileRequest.Builder,ObjectBuilder<EnableUserProfileRequest>> fn)	Enable a user profile.
EnrollKibanaResponse	enrollKibana()	Enroll Kibana.
EnrollNodeResponse	enrollNode()	Enroll a node.
GetApiKeyResponse	getApiKey()	Get API key information.
GetApiKeyResponse	getApiKey(GetApiKeyRequest request)	Get API key information.
final GetApiKeyResponse	getApiKey(Function<GetApiKeyRequest.Builder,ObjectBuilder<GetApiKeyRequest>> fn)	Get API key information.
GetBuiltinPrivilegesResponse	getBuiltinPrivileges()	Get builtin privileges.
GetPrivilegesResponse	getPrivileges()	Get application privileges.
GetPrivilegesResponse	getPrivileges(GetPrivilegesRequest request)	Get application privileges.
final GetPrivilegesResponse	getPrivileges(Function<GetPrivilegesRequest.Builder,ObjectBuilder<GetPrivilegesRequest>> fn)	Get application privileges.
GetRoleResponse	getRole()	Get roles.
GetRoleResponse	getRole(GetRoleRequest request)	Get roles.
final GetRoleResponse	getRole(Function<GetRoleRequest.Builder,ObjectBuilder<GetRoleRequest>> fn)	Get roles.
GetRoleMappingResponse	getRoleMapping()	Get role mappings.
GetRoleMappingResponse	getRoleMapping(GetRoleMappingRequest request)	Get role mappings.
final GetRoleMappingResponse	getRoleMapping(Function<GetRoleMappingRequest.Builder,ObjectBuilder<GetRoleMappingRequest>> fn)	Get role mappings.
GetServiceAccountsResponse	getServiceAccounts()	Get service accounts.
GetServiceAccountsResponse	getServiceAccounts(GetServiceAccountsRequest request)	Get service accounts.
final GetServiceAccountsResponse	getServiceAccounts(Function<GetServiceAccountsRequest.Builder,ObjectBuilder<GetServiceAccountsRequest>> fn)	Get service accounts.
GetServiceCredentialsResponse	getServiceCredentials(GetServiceCredentialsRequest request)	Get service account credentials.
final GetServiceCredentialsResponse	getServiceCredentials(Function<GetServiceCredentialsRequest.Builder,ObjectBuilder<GetServiceCredentialsRequest>> fn)	Get service account credentials.
GetSecuritySettingsResponse	getSettings()	Get security index settings.
GetSecuritySettingsResponse	getSettings(GetSecuritySettingsRequest request)	Get security index settings.
final GetSecuritySettingsResponse	getSettings(Function<GetSecuritySettingsRequest.Builder,ObjectBuilder<GetSecuritySettingsRequest>> fn)	Get security index settings.
GetTokenResponse	getToken()	Get a token.
GetTokenResponse	getToken(GetTokenRequest request)	Get a token.
final GetTokenResponse	getToken(Function<GetTokenRequest.Builder,ObjectBuilder<GetTokenRequest>> fn)	Get a token.
GetUserResponse	getUser()	Get users.
GetUserResponse	getUser(GetUserRequest request)	Get users.
final GetUserResponse	getUser(Function<GetUserRequest.Builder,ObjectBuilder<GetUserRequest>> fn)	Get users.
GetUserPrivilegesResponse	getUserPrivileges()	Get user privileges.
GetUserPrivilegesResponse	getUserPrivileges(GetUserPrivilegesRequest request)	Get user privileges.
final GetUserPrivilegesResponse	getUserPrivileges(Function<GetUserPrivilegesRequest.Builder,ObjectBuilder<GetUserPrivilegesRequest>> fn)	Get user privileges.
GetUserProfileResponse	getUserProfile(GetUserProfileRequest request)	Get a user profile.
final GetUserProfileResponse	getUserProfile(Function<GetUserProfileRequest.Builder,ObjectBuilder<GetUserProfileRequest>> fn)	Get a user profile.
GrantApiKeyResponse	grantApiKey(GrantApiKeyRequest request)	Grant an API key.
final GrantApiKeyResponse	grantApiKey(Function<GrantApiKeyRequest.Builder,ObjectBuilder<GrantApiKeyRequest>> fn)	Grant an API key.
HasPrivilegesResponse	hasPrivileges()	Check user privileges.
HasPrivilegesResponse	hasPrivileges(HasPrivilegesRequest request)	Check user privileges.
final HasPrivilegesResponse	hasPrivileges(Function<HasPrivilegesRequest.Builder,ObjectBuilder<HasPrivilegesRequest>> fn)	Check user privileges.
HasPrivilegesUserProfileResponse	hasPrivilegesUserProfile(HasPrivilegesUserProfileRequest request)	Check user profile privileges.
final HasPrivilegesUserProfileResponse	hasPrivilegesUserProfile(Function<HasPrivilegesUserProfileRequest.Builder,ObjectBuilder<HasPrivilegesUserProfileRequest>> fn)	Check user profile privileges.
InvalidateApiKeyResponse	invalidateApiKey()	Invalidate API keys.
InvalidateApiKeyResponse	invalidateApiKey(InvalidateApiKeyRequest request)	Invalidate API keys.
final InvalidateApiKeyResponse	invalidateApiKey(Function<InvalidateApiKeyRequest.Builder,ObjectBuilder<InvalidateApiKeyRequest>> fn)	Invalidate API keys.
InvalidateTokenResponse	invalidateToken()	Invalidate a token.
InvalidateTokenResponse	invalidateToken(InvalidateTokenRequest request)	Invalidate a token.
final InvalidateTokenResponse	invalidateToken(Function<InvalidateTokenRequest.Builder,ObjectBuilder<InvalidateTokenRequest>> fn)	Invalidate a token.
OidcAuthenticateResponse	oidcAuthenticate(OidcAuthenticateRequest request)	Authenticate OpenID Connect.
final OidcAuthenticateResponse	oidcAuthenticate(Function<OidcAuthenticateRequest.Builder,ObjectBuilder<OidcAuthenticateRequest>> fn)	Authenticate OpenID Connect.
OidcLogoutResponse	oidcLogout(OidcLogoutRequest request)	Logout of OpenID Connect.
final OidcLogoutResponse	oidcLogout(Function<OidcLogoutRequest.Builder,ObjectBuilder<OidcLogoutRequest>> fn)	Logout of OpenID Connect.
OidcPrepareAuthenticationResponse	oidcPrepareAuthentication()	Prepare OpenID connect authentication.
OidcPrepareAuthenticationResponse	oidcPrepareAuthentication(OidcPrepareAuthenticationRequest request)	Prepare OpenID connect authentication.
final OidcPrepareAuthenticationResponse	oidcPrepareAuthentication(Function<OidcPrepareAuthenticationRequest.Builder,ObjectBuilder<OidcPrepareAuthenticationRequest>> fn)	Prepare OpenID connect authentication.
PutPrivilegesResponse	putPrivileges()	Create or update application privileges.
PutPrivilegesResponse	putPrivileges(PutPrivilegesRequest request)	Create or update application privileges.
final PutPrivilegesResponse	putPrivileges(Function<PutPrivilegesRequest.Builder,ObjectBuilder<PutPrivilegesRequest>> fn)	Create or update application privileges.
PutRoleResponse	putRole(PutRoleRequest request)	Create or update roles.
final PutRoleResponse	putRole(Function<PutRoleRequest.Builder,ObjectBuilder<PutRoleRequest>> fn)	Create or update roles.
PutRoleMappingResponse	putRoleMapping(PutRoleMappingRequest request)	Create or update role mappings.
final PutRoleMappingResponse	putRoleMapping(Function<PutRoleMappingRequest.Builder,ObjectBuilder<PutRoleMappingRequest>> fn)	Create or update role mappings.
PutUserResponse	putUser(PutUserRequest request)	Create or update users.
final PutUserResponse	putUser(Function<PutUserRequest.Builder,ObjectBuilder<PutUserRequest>> fn)	Create or update users.
QueryApiKeysResponse	queryApiKeys()	Find API keys with a query.
QueryApiKeysResponse	queryApiKeys(QueryApiKeysRequest request)	Find API keys with a query.
final QueryApiKeysResponse	queryApiKeys(Function<QueryApiKeysRequest.Builder,ObjectBuilder<QueryApiKeysRequest>> fn)	Find API keys with a query.
QueryRoleResponse	queryRole()	Find roles with a query.
QueryRoleResponse	queryRole(QueryRoleRequest request)	Find roles with a query.
final QueryRoleResponse	queryRole(Function<QueryRoleRequest.Builder,ObjectBuilder<QueryRoleRequest>> fn)	Find roles with a query.
QueryUserResponse	queryUser()	Find users with a query.
QueryUserResponse	queryUser(QueryUserRequest request)	Find users with a query.
final QueryUserResponse	queryUser(Function<QueryUserRequest.Builder,ObjectBuilder<QueryUserRequest>> fn)	Find users with a query.
SamlAuthenticateResponse	samlAuthenticate(SamlAuthenticateRequest request)	Authenticate SAML.
final SamlAuthenticateResponse	samlAuthenticate(Function<SamlAuthenticateRequest.Builder,ObjectBuilder<SamlAuthenticateRequest>> fn)	Authenticate SAML.
BooleanResponse	samlCompleteLogout(SamlCompleteLogoutRequest request)	Logout of SAML completely.
final BooleanResponse	samlCompleteLogout(Function<SamlCompleteLogoutRequest.Builder,ObjectBuilder<SamlCompleteLogoutRequest>> fn)	Logout of SAML completely.
SamlInvalidateResponse	samlInvalidate(SamlInvalidateRequest request)	Invalidate SAML.
final SamlInvalidateResponse	samlInvalidate(Function<SamlInvalidateRequest.Builder,ObjectBuilder<SamlInvalidateRequest>> fn)	Invalidate SAML.
SamlLogoutResponse	samlLogout(SamlLogoutRequest request)	Logout of SAML.
final SamlLogoutResponse	samlLogout(Function<SamlLogoutRequest.Builder,ObjectBuilder<SamlLogoutRequest>> fn)	Logout of SAML.
SamlPrepareAuthenticationResponse	samlPrepareAuthentication()	Prepare SAML authentication.
SamlPrepareAuthenticationResponse	samlPrepareAuthentication(SamlPrepareAuthenticationRequest request)	Prepare SAML authentication.
final SamlPrepareAuthenticationResponse	samlPrepareAuthentication(Function<SamlPrepareAuthenticationRequest.Builder,ObjectBuilder<SamlPrepareAuthenticationRequest>> fn)	Prepare SAML authentication.
SamlServiceProviderMetadataResponse	samlServiceProviderMetadata(SamlServiceProviderMetadataRequest request)	Create SAML service provider metadata.
final SamlServiceProviderMetadataResponse	samlServiceProviderMetadata(Function<SamlServiceProviderMetadataRequest.Builder,ObjectBuilder<SamlServiceProviderMetadataRequest>> fn)	Create SAML service provider metadata.
SuggestUserProfilesResponse	suggestUserProfiles()	Suggest a user profile.
SuggestUserProfilesResponse	suggestUserProfiles(SuggestUserProfilesRequest request)	Suggest a user profile.
final SuggestUserProfilesResponse	suggestUserProfiles(Function<SuggestUserProfilesRequest.Builder,ObjectBuilder<SuggestUserProfilesRequest>> fn)	Suggest a user profile.
UpdateApiKeyResponse	updateApiKey(UpdateApiKeyRequest request)	Update an API key.
final UpdateApiKeyResponse	updateApiKey(Function<UpdateApiKeyRequest.Builder,ObjectBuilder<UpdateApiKeyRequest>> fn)	Update an API key.
UpdateCrossClusterApiKeyResponse	updateCrossClusterApiKey(UpdateCrossClusterApiKeyRequest request)	Update a cross-cluster API key.
final UpdateCrossClusterApiKeyResponse	updateCrossClusterApiKey(Function<UpdateCrossClusterApiKeyRequest.Builder,ObjectBuilder<UpdateCrossClusterApiKeyRequest>> fn)	Update a cross-cluster API key.
UpdateSettingsResponse	updateSettings()	Update security index settings.
UpdateSettingsResponse	updateSettings(UpdateSettingsRequest request)	Update security index settings.
final UpdateSettingsResponse	updateSettings(Function<UpdateSettingsRequest.Builder,ObjectBuilder<UpdateSettingsRequest>> fn)	Update security index settings.
UpdateUserProfileDataResponse	updateUserProfileData(UpdateUserProfileDataRequest request)	Update user profile data.
final UpdateUserProfileDataResponse	updateUserProfileData(Function<UpdateUserProfileDataRequest.Builder,ObjectBuilder<UpdateUserProfileDataRequest>> fn)	Update user profile data.
ElasticsearchSecurityClient	withTransportOptions(TransportOptions transportOptions)	Creates a new client with some request options

Methods inherited from class co.elastic.clients.ApiClient

_jsonpMapper, _transport, _transportOptions, close, getDeserializer, withTransportOptions

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ElasticsearchSecurityClient

public ElasticsearchSecurityClient(ElasticsearchTransport transport)

ElasticsearchSecurityClient

public ElasticsearchSecurityClient(ElasticsearchTransport transport,
 @Nullable
 TransportOptions transportOptions)

Method Details

withTransportOptions

public ElasticsearchSecurityClient withTransportOptions(@Nullable
 TransportOptions transportOptions)

Description copied from class: ApiClient

Creates a new client with some request options

Specified by:

withTransportOptions in class ApiClient<ElasticsearchTransport,ElasticsearchSecurityClient>

activateUserProfile

public ActivateUserProfileResponse activateUserProfile(ActivateUserProfileRequest request)
                                                throws IOException,
ElasticsearchException

Activate a user profile.

Create or update a user profile on behalf of another user.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. The calling application must have either an access_token or a combination of username and password for the user that the profile document is intended for. Elastic reserves the right to change or remove this feature in future releases without prior notice.

This API creates or updates a profile document for end users with information that is extracted from the user's authentication object including username, full_name, roles, and the authentication realm. For example, in the JWT access_token case, the profile user's username is extracted from the JWT token claim pointed to by the claims.principal setting of the JWT realm that authenticated the token.

When updating a profile document, the API enables the document if it was disabled. Any updates do not change existing content for either the labels or data fields.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

activateUserProfile

public final ActivateUserProfileResponse activateUserProfile(Function<ActivateUserProfileRequest.Builder,ObjectBuilder<ActivateUserProfileRequest>> fn)
                                                      throws IOException,
ElasticsearchException

Activate a user profile.

Create or update a user profile on behalf of another user.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. The calling application must have either an access_token or a combination of username and password for the user that the profile document is intended for. Elastic reserves the right to change or remove this feature in future releases without prior notice.

This API creates or updates a profile document for end users with information that is extracted from the user's authentication object including username, full_name, roles, and the authentication realm. For example, in the JWT access_token case, the profile user's username is extracted from the JWT token claim pointed to by the claims.principal setting of the JWT realm that authenticated the token.

When updating a profile document, the API enables the document if it was disabled. Any updates do not change existing content for either the labels or data fields.

Parameters:

fn - a function that initializes a builder to create the ActivateUserProfileRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

authenticate

public AuthenticateResponse authenticate()
                                  throws IOException,
ElasticsearchException

Authenticate a user.

Authenticates a user and returns information about the authenticated user. Include the user information in a basic auth header. A successful call returns a JSON structure that shows user information such as their username, the roles that are assigned to the user, any assigned metadata, and information about the realms that authenticated and authorized the user. If the user cannot be authenticated, this API returns a 401 status code.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkDeleteRole

public BulkDeleteRoleResponse bulkDeleteRole(BulkDeleteRoleRequest request)
                                      throws IOException,
ElasticsearchException

Bulk delete roles.

The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk delete roles API cannot delete roles that are defined in roles files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkDeleteRole

public final BulkDeleteRoleResponse bulkDeleteRole(Function<BulkDeleteRoleRequest.Builder,ObjectBuilder<BulkDeleteRoleRequest>> fn)
                                            throws IOException,
ElasticsearchException

Bulk delete roles.

The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk delete roles API cannot delete roles that are defined in roles files.

Parameters:

fn - a function that initializes a builder to create the BulkDeleteRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkPutRole

public BulkPutRoleResponse bulkPutRole(BulkPutRoleRequest request)
                                throws IOException,
ElasticsearchException

Bulk create or update roles.

The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk create or update roles API cannot update roles that are defined in roles files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkPutRole

public final BulkPutRoleResponse bulkPutRole(Function<BulkPutRoleRequest.Builder,ObjectBuilder<BulkPutRoleRequest>> fn)
                                      throws IOException,
ElasticsearchException

Bulk create or update roles.

The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk create or update roles API cannot update roles that are defined in roles files.

Parameters:

fn - a function that initializes a builder to create the BulkPutRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkUpdateApiKeys

public BulkUpdateApiKeysResponse bulkUpdateApiKeys(BulkUpdateApiKeysRequest request)
                                            throws IOException,
ElasticsearchException

Bulk update API keys. Update the attributes for multiple API keys.

IMPORTANT: It is not possible to use an API key as the authentication credential for this API. To update API keys, the owner user's credentials are required.

This API is similar to the update API key API but enables you to apply the same update to multiple API keys in one API call. This operation can greatly improve performance over making individual updates.

It is not possible to update expired or invalidated API keys.

This API supports updates to API key access scope, metadata and expiration. The access scope of each API key is derived from the role_descriptors you specify in the request and a snapshot of the owner user's permissions at the time of the request. The snapshot of the owner's permissions is updated automatically on every call.

IMPORTANT: If you don't specify role_descriptors in the request, a call to this API might still change an API key's access scope. This change can occur if the owner user's permissions have changed since the API key was created or last modified.

A successful request returns a JSON structure that contains the IDs of all updated API keys, the IDs of API keys that already had the requested changes and did not require an update, and error details for any failed update.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

bulkUpdateApiKeys

public final BulkUpdateApiKeysResponse bulkUpdateApiKeys(Function<BulkUpdateApiKeysRequest.Builder,ObjectBuilder<BulkUpdateApiKeysRequest>> fn)
                                                  throws IOException,
ElasticsearchException

Bulk update API keys. Update the attributes for multiple API keys.

IMPORTANT: It is not possible to use an API key as the authentication credential for this API. To update API keys, the owner user's credentials are required.

This API is similar to the update API key API but enables you to apply the same update to multiple API keys in one API call. This operation can greatly improve performance over making individual updates.

It is not possible to update expired or invalidated API keys.

This API supports updates to API key access scope, metadata and expiration. The access scope of each API key is derived from the role_descriptors you specify in the request and a snapshot of the owner user's permissions at the time of the request. The snapshot of the owner's permissions is updated automatically on every call.

IMPORTANT: If you don't specify role_descriptors in the request, a call to this API might still change an API key's access scope. This change can occur if the owner user's permissions have changed since the API key was created or last modified.

A successful request returns a JSON structure that contains the IDs of all updated API keys, the IDs of API keys that already had the requested changes and did not require an update, and error details for any failed update.

Parameters:

fn - a function that initializes a builder to create the BulkUpdateApiKeysRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

changePassword

public ChangePasswordResponse changePassword(ChangePasswordRequest request)
                                      throws IOException,
ElasticsearchException

Change passwords.

Change the passwords of users in the native realm and built-in users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

changePassword

public final ChangePasswordResponse changePassword(Function<ChangePasswordRequest.Builder,ObjectBuilder<ChangePasswordRequest>> fn)
                                            throws IOException,
ElasticsearchException

Change passwords.

Change the passwords of users in the native realm and built-in users.

Parameters:

fn - a function that initializes a builder to create the ChangePasswordRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

changePassword

public ChangePasswordResponse changePassword()
                                      throws IOException,
ElasticsearchException

Change passwords.

Change the passwords of users in the native realm and built-in users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearApiKeyCache

public ClearApiKeyCacheResponse clearApiKeyCache(ClearApiKeyCacheRequest request)
                                          throws IOException,
ElasticsearchException

Clear the API key cache.

Evict a subset of all entries from the API key cache. The cache is also automatically cleared on state changes of the security index.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearApiKeyCache

public final ClearApiKeyCacheResponse clearApiKeyCache(Function<ClearApiKeyCacheRequest.Builder,ObjectBuilder<ClearApiKeyCacheRequest>> fn)
                                                throws IOException,
ElasticsearchException

Clear the API key cache.

Evict a subset of all entries from the API key cache. The cache is also automatically cleared on state changes of the security index.

Parameters:

fn - a function that initializes a builder to create the ClearApiKeyCacheRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedPrivileges

public ClearCachedPrivilegesResponse clearCachedPrivileges(ClearCachedPrivilegesRequest request)
                                                    throws IOException,
ElasticsearchException

Clear the privileges cache.

Evict privileges from the native application privilege cache. The cache is also automatically cleared for applications that have their privileges updated.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedPrivileges

public final ClearCachedPrivilegesResponse clearCachedPrivileges(Function<ClearCachedPrivilegesRequest.Builder,ObjectBuilder<ClearCachedPrivilegesRequest>> fn)
                                                          throws IOException,
ElasticsearchException

Clear the privileges cache.

Evict privileges from the native application privilege cache. The cache is also automatically cleared for applications that have their privileges updated.

Parameters:

fn - a function that initializes a builder to create the ClearCachedPrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedRealms

public ClearCachedRealmsResponse clearCachedRealms(ClearCachedRealmsRequest request)
                                            throws IOException,
ElasticsearchException

Clear the user cache.

Evict users from the user cache. You can completely clear the cache or evict specific users.

User credentials are cached in memory on each node to avoid connecting to a remote authentication service or hitting the disk for every incoming request. There are realm settings that you can use to configure the user cache. For more information, refer to the documentation about controlling the user cache.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedRealms

public final ClearCachedRealmsResponse clearCachedRealms(Function<ClearCachedRealmsRequest.Builder,ObjectBuilder<ClearCachedRealmsRequest>> fn)
                                                  throws IOException,
ElasticsearchException

Clear the user cache.

Evict users from the user cache. You can completely clear the cache or evict specific users.

User credentials are cached in memory on each node to avoid connecting to a remote authentication service or hitting the disk for every incoming request. There are realm settings that you can use to configure the user cache. For more information, refer to the documentation about controlling the user cache.

Parameters:

fn - a function that initializes a builder to create the ClearCachedRealmsRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedRoles

public ClearCachedRolesResponse clearCachedRoles(ClearCachedRolesRequest request)
                                          throws IOException,
ElasticsearchException

Clear the roles cache.

Evict roles from the native role cache.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedRoles

public final ClearCachedRolesResponse clearCachedRoles(Function<ClearCachedRolesRequest.Builder,ObjectBuilder<ClearCachedRolesRequest>> fn)
                                                throws IOException,
ElasticsearchException

Clear the roles cache.

Evict roles from the native role cache.

Parameters:

fn - a function that initializes a builder to create the ClearCachedRolesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedServiceTokens

public ClearCachedServiceTokensResponse clearCachedServiceTokens(ClearCachedServiceTokensRequest request)
                                                          throws IOException,
ElasticsearchException

Clear service account token caches.

Evict a subset of all entries from the service account token caches. Two separate caches exist for service account tokens: one cache for tokens backed by the service_tokens file, and another for tokens backed by the .security index. This API clears matching entries from both caches.

The cache for service account tokens backed by the .security index is cleared automatically on state changes of the security index. The cache for tokens backed by the service_tokens file is cleared automatically on file changes.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

clearCachedServiceTokens

public final ClearCachedServiceTokensResponse clearCachedServiceTokens(Function<ClearCachedServiceTokensRequest.Builder,ObjectBuilder<ClearCachedServiceTokensRequest>> fn)
                                                                throws IOException,
ElasticsearchException

Clear service account token caches.

Evict a subset of all entries from the service account token caches. Two separate caches exist for service account tokens: one cache for tokens backed by the service_tokens file, and another for tokens backed by the .security index. This API clears matching entries from both caches.

The cache for service account tokens backed by the .security index is cleared automatically on state changes of the security index. The cache for tokens backed by the service_tokens file is cleared automatically on file changes.

Parameters:

fn - a function that initializes a builder to create the ClearCachedServiceTokensRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createApiKey

public CreateApiKeyResponse createApiKey(CreateApiKeyRequest request)
                                  throws IOException,
ElasticsearchException

Create an API key.

Create an API key for access without requiring basic authentication.

IMPORTANT: If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.

A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

NOTE: By default, API keys never expire. You can specify expiration information when you create the API keys.

The API keys are created by the Elasticsearch API key service, which is automatically enabled. To configure or turn off the API key service, refer to API key service setting documentation.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createApiKey

public final CreateApiKeyResponse createApiKey(Function<CreateApiKeyRequest.Builder,ObjectBuilder<CreateApiKeyRequest>> fn)
                                        throws IOException,
ElasticsearchException

Create an API key.

Create an API key for access without requiring basic authentication.

IMPORTANT: If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.

A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

NOTE: By default, API keys never expire. You can specify expiration information when you create the API keys.

The API keys are created by the Elasticsearch API key service, which is automatically enabled. To configure or turn off the API key service, refer to API key service setting documentation.

Parameters:

fn - a function that initializes a builder to create the CreateApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createApiKey

public CreateApiKeyResponse createApiKey()
                                  throws IOException,
ElasticsearchException

Create an API key.

Create an API key for access without requiring basic authentication.

IMPORTANT: If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.

A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

NOTE: By default, API keys never expire. You can specify expiration information when you create the API keys.

The API keys are created by the Elasticsearch API key service, which is automatically enabled. To configure or turn off the API key service, refer to API key service setting documentation.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createCrossClusterApiKey

public CreateCrossClusterApiKeyResponse createCrossClusterApiKey(CreateCrossClusterApiKeyRequest request)
                                                          throws IOException,
ElasticsearchException

Create a cross-cluster API key.

Create an API key of the cross_cluster type for the API key based remote cluster access. A cross_cluster API key cannot be used to authenticate through the REST interface.

IMPORTANT: To authenticate this request you must use a credential that is not an API key. Even if you use an API key that has the required privilege, the API returns an error.

Cross-cluster API keys are created by the Elasticsearch API key service, which is automatically enabled.

NOTE: Unlike REST API keys, a cross-cluster API key does not capture permissions of the authenticated user. The API key’s effective permission is exactly as specified with the access property.

A successful request returns a JSON structure that contains the API key, its unique ID, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

By default, API keys never expire. You can specify expiration information when you create the API keys.

Cross-cluster API keys can only be updated with the update cross-cluster API key API. Attempting to update them with the update REST API key API or the bulk update REST API keys API will result in an error.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createCrossClusterApiKey

public final CreateCrossClusterApiKeyResponse createCrossClusterApiKey(Function<CreateCrossClusterApiKeyRequest.Builder,ObjectBuilder<CreateCrossClusterApiKeyRequest>> fn)
                                                                throws IOException,
ElasticsearchException

Create a cross-cluster API key.

Create an API key of the cross_cluster type for the API key based remote cluster access. A cross_cluster API key cannot be used to authenticate through the REST interface.

IMPORTANT: To authenticate this request you must use a credential that is not an API key. Even if you use an API key that has the required privilege, the API returns an error.

Cross-cluster API keys are created by the Elasticsearch API key service, which is automatically enabled.

NOTE: Unlike REST API keys, a cross-cluster API key does not capture permissions of the authenticated user. The API key’s effective permission is exactly as specified with the access property.

A successful request returns a JSON structure that contains the API key, its unique ID, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

By default, API keys never expire. You can specify expiration information when you create the API keys.

Cross-cluster API keys can only be updated with the update cross-cluster API key API. Attempting to update them with the update REST API key API or the bulk update REST API keys API will result in an error.

Parameters:

fn - a function that initializes a builder to create the CreateCrossClusterApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createServiceToken

public CreateServiceTokenResponse createServiceToken(CreateServiceTokenRequest request)
                                              throws IOException,
ElasticsearchException

Create a service account token.

Create a service accounts token for access without requiring basic authentication.

NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

createServiceToken

public final CreateServiceTokenResponse createServiceToken(Function<CreateServiceTokenRequest.Builder,ObjectBuilder<CreateServiceTokenRequest>> fn)
                                                    throws IOException,
ElasticsearchException

Create a service account token.

Create a service accounts token for access without requiring basic authentication.

NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed.

Parameters:

fn - a function that initializes a builder to create the CreateServiceTokenRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

delegatePki

public DelegatePkiResponse delegatePki(DelegatePkiRequest request)
                                throws IOException,
ElasticsearchException

Delegate PKI authentication.

This API implements the exchange of an X509Certificate chain for an Elasticsearch access token. The certificate chain is validated, according to RFC 5280, by sequentially considering the trust configuration of every installed PKI realm that has delegation.enabled set to true. A successfully trusted client certificate is also subject to the validation of the subject distinguished name according to thw username_pattern of the respective realm.

This API is called by smart and trusted proxies, such as Kibana, which terminate the user's TLS session but still want to authenticate the user by using a PKI realm—-as if the user connected directly to Elasticsearch.

IMPORTANT: The association between the subject public key in the target certificate and the corresponding private key is not validated. This is part of the TLS authentication process and it is delegated to the proxy that calls this API. The proxy is trusted to have performed the TLS authentication and this API translates that authentication into an Elasticsearch access token.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

delegatePki

public final DelegatePkiResponse delegatePki(Function<DelegatePkiRequest.Builder,ObjectBuilder<DelegatePkiRequest>> fn)
                                      throws IOException,
ElasticsearchException

Delegate PKI authentication.

This API implements the exchange of an X509Certificate chain for an Elasticsearch access token. The certificate chain is validated, according to RFC 5280, by sequentially considering the trust configuration of every installed PKI realm that has delegation.enabled set to true. A successfully trusted client certificate is also subject to the validation of the subject distinguished name according to thw username_pattern of the respective realm.

This API is called by smart and trusted proxies, such as Kibana, which terminate the user's TLS session but still want to authenticate the user by using a PKI realm—-as if the user connected directly to Elasticsearch.

IMPORTANT: The association between the subject public key in the target certificate and the corresponding private key is not validated. This is part of the TLS authentication process and it is delegated to the proxy that calls this API. The proxy is trusted to have performed the TLS authentication and this API translates that authentication into an Elasticsearch access token.

Parameters:

fn - a function that initializes a builder to create the DelegatePkiRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deletePrivileges

public DeletePrivilegesResponse deletePrivileges(DeletePrivilegesRequest request)
                                          throws IOException,
ElasticsearchException

Delete application privileges.

To use this API, you must have one of the following privileges:

• The manage_security cluster privilege (or a greater privilege such as all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deletePrivileges

public final DeletePrivilegesResponse deletePrivileges(Function<DeletePrivilegesRequest.Builder,ObjectBuilder<DeletePrivilegesRequest>> fn)
                                                throws IOException,
ElasticsearchException

Delete application privileges.

To use this API, you must have one of the following privileges:

• The manage_security cluster privilege (or a greater privilege such as all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Parameters:

fn - a function that initializes a builder to create the DeletePrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteRole

public DeleteRoleResponse deleteRole(DeleteRoleRequest request)
                              throws IOException,
ElasticsearchException

Delete roles.

Delete roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The delete roles API cannot remove roles that are defined in roles files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteRole

public final DeleteRoleResponse deleteRole(Function<DeleteRoleRequest.Builder,ObjectBuilder<DeleteRoleRequest>> fn)
                                    throws IOException,
ElasticsearchException

Delete roles.

Delete roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The delete roles API cannot remove roles that are defined in roles files.

Parameters:

fn - a function that initializes a builder to create the DeleteRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteRoleMapping

public DeleteRoleMappingResponse deleteRoleMapping(DeleteRoleMappingRequest request)
                                            throws IOException,
ElasticsearchException

Delete role mappings.

Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The delete role mappings API cannot remove role mappings that are defined in role mapping files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteRoleMapping

public final DeleteRoleMappingResponse deleteRoleMapping(Function<DeleteRoleMappingRequest.Builder,ObjectBuilder<DeleteRoleMappingRequest>> fn)
                                                  throws IOException,
ElasticsearchException

Delete role mappings.

Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The delete role mappings API cannot remove role mappings that are defined in role mapping files.

Parameters:

fn - a function that initializes a builder to create the DeleteRoleMappingRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteServiceToken

public DeleteServiceTokenResponse deleteServiceToken(DeleteServiceTokenRequest request)
                                              throws IOException,
ElasticsearchException

Delete service account tokens.

Delete service account tokens for a service in a specified namespace.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteServiceToken

public final DeleteServiceTokenResponse deleteServiceToken(Function<DeleteServiceTokenRequest.Builder,ObjectBuilder<DeleteServiceTokenRequest>> fn)
                                                    throws IOException,
ElasticsearchException

Delete service account tokens.

Delete service account tokens for a service in a specified namespace.

Parameters:

fn - a function that initializes a builder to create the DeleteServiceTokenRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteUser

public DeleteUserResponse deleteUser(DeleteUserRequest request)
                              throws IOException,
ElasticsearchException

Delete users.

Delete users from the native realm.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

deleteUser

public final DeleteUserResponse deleteUser(Function<DeleteUserRequest.Builder,ObjectBuilder<DeleteUserRequest>> fn)
                                    throws IOException,
ElasticsearchException

Delete users.

Delete users from the native realm.

Parameters:

fn - a function that initializes a builder to create the DeleteUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

disableUser

public DisableUserResponse disableUser(DisableUserRequest request)
                                throws IOException,
ElasticsearchException

Disable users.

Disable users in the native realm. By default, when you create users, they are enabled. You can use this API to revoke a user's access to Elasticsearch.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

disableUser

public final DisableUserResponse disableUser(Function<DisableUserRequest.Builder,ObjectBuilder<DisableUserRequest>> fn)
                                      throws IOException,
ElasticsearchException

Disable users.

Disable users in the native realm. By default, when you create users, they are enabled. You can use this API to revoke a user's access to Elasticsearch.

Parameters:

fn - a function that initializes a builder to create the DisableUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

disableUserProfile

public DisableUserProfileResponse disableUserProfile(DisableUserProfileRequest request)
                                              throws IOException,
ElasticsearchException

Disable a user profile.

Disable user profiles so that they are not visible in user profile searches.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

When you activate a user profile, its automatically enabled and visible in user profile searches. You can use the disable user profile API to disable a user profile so it’s not visible in these searches. To re-enable a disabled user profile, use the enable user profile API .

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

disableUserProfile

public final DisableUserProfileResponse disableUserProfile(Function<DisableUserProfileRequest.Builder,ObjectBuilder<DisableUserProfileRequest>> fn)
                                                    throws IOException,
ElasticsearchException

Disable a user profile.

Disable user profiles so that they are not visible in user profile searches.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

When you activate a user profile, its automatically enabled and visible in user profile searches. You can use the disable user profile API to disable a user profile so it’s not visible in these searches. To re-enable a disabled user profile, use the enable user profile API .

Parameters:

fn - a function that initializes a builder to create the DisableUserProfileRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enableUser

public EnableUserResponse enableUser(EnableUserRequest request)
                              throws IOException,
ElasticsearchException

Enable users.

Enable users in the native realm. By default, when you create users, they are enabled.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enableUser

public final EnableUserResponse enableUser(Function<EnableUserRequest.Builder,ObjectBuilder<EnableUserRequest>> fn)
                                    throws IOException,
ElasticsearchException

Enable users.

Enable users in the native realm. By default, when you create users, they are enabled.

Parameters:

fn - a function that initializes a builder to create the EnableUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enableUserProfile

public EnableUserProfileResponse enableUserProfile(EnableUserProfileRequest request)
                                            throws IOException,
ElasticsearchException

Enable a user profile.

Enable user profiles to make them visible in user profile searches.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

When you activate a user profile, it's automatically enabled and visible in user profile searches. If you later disable the user profile, you can use the enable user profile API to make the profile visible in these searches again.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enableUserProfile

public final EnableUserProfileResponse enableUserProfile(Function<EnableUserProfileRequest.Builder,ObjectBuilder<EnableUserProfileRequest>> fn)
                                                  throws IOException,
ElasticsearchException

Enable a user profile.

Enable user profiles to make them visible in user profile searches.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

When you activate a user profile, it's automatically enabled and visible in user profile searches. If you later disable the user profile, you can use the enable user profile API to make the profile visible in these searches again.

Parameters:

fn - a function that initializes a builder to create the EnableUserProfileRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enrollKibana

public EnrollKibanaResponse enrollKibana()
                                  throws IOException,
ElasticsearchException

Enroll Kibana.

Enable a Kibana instance to configure itself for communication with a secured Elasticsearch cluster.

NOTE: This API is currently intended for internal use only by Kibana. Kibana uses this API internally to configure itself for communications with an Elasticsearch cluster that already has security features enabled.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

enrollNode

public EnrollNodeResponse enrollNode()
                              throws IOException,
ElasticsearchException

Enroll a node.

Enroll a new node to allow it to join an existing cluster with security features enabled.

The response contains all the necessary information for the joining node to bootstrap discovery and security related settings so that it can successfully join the cluster. The response contains key and certificate material that allows the caller to generate valid signed certificates for the HTTP layer of all nodes in the cluster.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getApiKey

public GetApiKeyResponse getApiKey(GetApiKeyRequest request)
                            throws IOException,
ElasticsearchException

Get API key information.

Retrieves information for one or more API keys. NOTE: If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have read_security, manage_api_key or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getApiKey

public final GetApiKeyResponse getApiKey(Function<GetApiKeyRequest.Builder,ObjectBuilder<GetApiKeyRequest>> fn)
                                  throws IOException,
ElasticsearchException

Get API key information.

Retrieves information for one or more API keys. NOTE: If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have read_security, manage_api_key or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Parameters:

fn - a function that initializes a builder to create the GetApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getApiKey

public GetApiKeyResponse getApiKey()
                            throws IOException,
ElasticsearchException

Get API key information.

Retrieves information for one or more API keys. NOTE: If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have read_security, manage_api_key or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getBuiltinPrivileges

public GetBuiltinPrivilegesResponse getBuiltinPrivileges()
                                                  throws IOException,
ElasticsearchException

Get builtin privileges.

Get the list of cluster privileges and index privileges that are available in this version of Elasticsearch.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getPrivileges

public GetPrivilegesResponse getPrivileges(GetPrivilegesRequest request)
                                    throws IOException,
ElasticsearchException

Get application privileges.

To use this API, you must have one of the following privileges:

• The read_security cluster privilege (or a greater privilege such as manage_security or all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getPrivileges

public final GetPrivilegesResponse getPrivileges(Function<GetPrivilegesRequest.Builder,ObjectBuilder<GetPrivilegesRequest>> fn)
                                          throws IOException,
ElasticsearchException

Get application privileges.

To use this API, you must have one of the following privileges:

• The read_security cluster privilege (or a greater privilege such as manage_security or all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Parameters:

fn - a function that initializes a builder to create the GetPrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getPrivileges

public GetPrivilegesResponse getPrivileges()
                                    throws IOException,
ElasticsearchException

Get application privileges.

To use this API, you must have one of the following privileges:

• The read_security cluster privilege (or a greater privilege such as manage_security or all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRole

public GetRoleResponse getRole(GetRoleRequest request)
                        throws IOException,
ElasticsearchException

Get roles.

Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRole

public final GetRoleResponse getRole(Function<GetRoleRequest.Builder,ObjectBuilder<GetRoleRequest>> fn)
                              throws IOException,
ElasticsearchException

Get roles.

Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files.

Parameters:

fn - a function that initializes a builder to create the GetRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRole

public GetRoleResponse getRole()
                        throws IOException,
ElasticsearchException

Get roles.

Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRoleMapping

public GetRoleMappingResponse getRoleMapping(GetRoleMappingRequest request)
                                      throws IOException,
ElasticsearchException

Get role mappings.

Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The get role mappings API cannot retrieve role mappings that are defined in role mapping files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRoleMapping

public final GetRoleMappingResponse getRoleMapping(Function<GetRoleMappingRequest.Builder,ObjectBuilder<GetRoleMappingRequest>> fn)
                                            throws IOException,
ElasticsearchException

Get role mappings.

Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The get role mappings API cannot retrieve role mappings that are defined in role mapping files.

Parameters:

fn - a function that initializes a builder to create the GetRoleMappingRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getRoleMapping

public GetRoleMappingResponse getRoleMapping()
                                      throws IOException,
ElasticsearchException

Get role mappings.

Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The get role mappings API cannot retrieve role mappings that are defined in role mapping files.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getServiceAccounts

public GetServiceAccountsResponse getServiceAccounts(GetServiceAccountsRequest request)
                                              throws IOException,
ElasticsearchException

Get service accounts.

Get a list of service accounts that match the provided path parameters.

NOTE: Currently, only the elastic/fleet-server service account is available.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getServiceAccounts

public final GetServiceAccountsResponse getServiceAccounts(Function<GetServiceAccountsRequest.Builder,ObjectBuilder<GetServiceAccountsRequest>> fn)
                                                    throws IOException,
ElasticsearchException

Get service accounts.

Get a list of service accounts that match the provided path parameters.

NOTE: Currently, only the elastic/fleet-server service account is available.

Parameters:

fn - a function that initializes a builder to create the GetServiceAccountsRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getServiceAccounts

public GetServiceAccountsResponse getServiceAccounts()
                                              throws IOException,
ElasticsearchException

Get service accounts.

Get a list of service accounts that match the provided path parameters.

NOTE: Currently, only the elastic/fleet-server service account is available.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getServiceCredentials

public GetServiceCredentialsResponse getServiceCredentials(GetServiceCredentialsRequest request)
                                                    throws IOException,
ElasticsearchException

Get service account credentials.

To use this API, you must have at least the read_security cluster privilege (or a greater privilege such as manage_service_account or manage_security).

The response includes service account tokens that were created with the create service account tokens API as well as file-backed tokens from all nodes of the cluster.

NOTE: For tokens backed by the service_tokens file, the API collects them from all nodes of the cluster. Tokens with the same name from different nodes are assumed to be the same token and are only counted once towards the total number of service tokens.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getServiceCredentials

public final GetServiceCredentialsResponse getServiceCredentials(Function<GetServiceCredentialsRequest.Builder,ObjectBuilder<GetServiceCredentialsRequest>> fn)
                                                          throws IOException,
ElasticsearchException

Get service account credentials.

To use this API, you must have at least the read_security cluster privilege (or a greater privilege such as manage_service_account or manage_security).

The response includes service account tokens that were created with the create service account tokens API as well as file-backed tokens from all nodes of the cluster.

NOTE: For tokens backed by the service_tokens file, the API collects them from all nodes of the cluster. Tokens with the same name from different nodes are assumed to be the same token and are only counted once towards the total number of service tokens.

Parameters:

fn - a function that initializes a builder to create the GetServiceCredentialsRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getSettings

public GetSecuritySettingsResponse getSettings(GetSecuritySettingsRequest request)
                                        throws IOException,
ElasticsearchException

Get security index settings.

Get the user-configurable settings for the security internal index (.security and associated indices). Only a subset of the index settings — those that are user-configurable—will be shown. This includes:

• index.auto_expand_replicas
• index.number_of_replicas

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getSettings

public final GetSecuritySettingsResponse getSettings(Function<GetSecuritySettingsRequest.Builder,ObjectBuilder<GetSecuritySettingsRequest>> fn)
                                              throws IOException,
ElasticsearchException

Get security index settings.

Get the user-configurable settings for the security internal index (.security and associated indices). Only a subset of the index settings — those that are user-configurable—will be shown. This includes:

• index.auto_expand_replicas
• index.number_of_replicas

Parameters:

fn - a function that initializes a builder to create the GetSecuritySettingsRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getSettings

public GetSecuritySettingsResponse getSettings()
                                        throws IOException,
ElasticsearchException

Get security index settings.

Get the user-configurable settings for the security internal index (.security and associated indices). Only a subset of the index settings — those that are user-configurable—will be shown. This includes:

• index.auto_expand_replicas
• index.number_of_replicas

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getToken

public GetTokenResponse getToken(GetTokenRequest request)
                          throws IOException,
ElasticsearchException

Get a token.

Create a bearer token for access without requiring basic authentication. The tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface. Alternatively, you can explicitly enable the xpack.security.authc.token.enabled setting. When you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface.

The get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body.

A successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available.

The tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used. That time period is defined by the xpack.security.authc.token.timeout setting. If you want to invalidate a token immediately, you can do so by using the invalidate token API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getToken

public final GetTokenResponse getToken(Function<GetTokenRequest.Builder,ObjectBuilder<GetTokenRequest>> fn)
                                throws IOException,
ElasticsearchException

Get a token.

Create a bearer token for access without requiring basic authentication. The tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface. Alternatively, you can explicitly enable the xpack.security.authc.token.enabled setting. When you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface.

The get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body.

A successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available.

The tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used. That time period is defined by the xpack.security.authc.token.timeout setting. If you want to invalidate a token immediately, you can do so by using the invalidate token API.

Parameters:

fn - a function that initializes a builder to create the GetTokenRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getToken

public GetTokenResponse getToken()
                          throws IOException,
ElasticsearchException

Get a token.

Create a bearer token for access without requiring basic authentication. The tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface. Alternatively, you can explicitly enable the xpack.security.authc.token.enabled setting. When you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface.

The get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body.

A successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available.

The tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used. That time period is defined by the xpack.security.authc.token.timeout setting. If you want to invalidate a token immediately, you can do so by using the invalidate token API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUser

public GetUserResponse getUser(GetUserRequest request)
                        throws IOException,
ElasticsearchException

Get users.

Get information about users in the native realm and built-in users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUser

public final GetUserResponse getUser(Function<GetUserRequest.Builder,ObjectBuilder<GetUserRequest>> fn)
                              throws IOException,
ElasticsearchException

Get users.

Get information about users in the native realm and built-in users.

Parameters:

fn - a function that initializes a builder to create the GetUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUser

public GetUserResponse getUser()
                        throws IOException,
ElasticsearchException

Get users.

Get information about users in the native realm and built-in users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUserPrivileges

public GetUserPrivilegesResponse getUserPrivileges(GetUserPrivilegesRequest request)
                                            throws IOException,
ElasticsearchException

Get user privileges.

Get the security privileges for the logged in user. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature. To check whether a user has a specific list of privileges, use the has privileges API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUserPrivileges

public final GetUserPrivilegesResponse getUserPrivileges(Function<GetUserPrivilegesRequest.Builder,ObjectBuilder<GetUserPrivilegesRequest>> fn)
                                                  throws IOException,
ElasticsearchException

Get user privileges.

Get the security privileges for the logged in user. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature. To check whether a user has a specific list of privileges, use the has privileges API.

Parameters:

fn - a function that initializes a builder to create the GetUserPrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUserPrivileges

public GetUserPrivilegesResponse getUserPrivileges()
                                            throws IOException,
ElasticsearchException

Get user privileges.

Get the security privileges for the logged in user. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature. To check whether a user has a specific list of privileges, use the has privileges API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUserProfile

public GetUserProfileResponse getUserProfile(GetUserProfileRequest request)
                                      throws IOException,
ElasticsearchException

Get a user profile.

Get a user's profile using the unique profile ID.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

getUserProfile

public final GetUserProfileResponse getUserProfile(Function<GetUserProfileRequest.Builder,ObjectBuilder<GetUserProfileRequest>> fn)
                                            throws IOException,
ElasticsearchException

Get a user profile.

Get a user's profile using the unique profile ID.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Parameters:

fn - a function that initializes a builder to create the GetUserProfileRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

grantApiKey

public GrantApiKeyResponse grantApiKey(GrantApiKeyRequest request)
                                throws IOException,
ElasticsearchException

Grant an API key.

Create an API key on behalf of another user. This API is similar to the create API keys API, however it creates the API key for a user that is different than the user that runs the API. The caller must have authentication credentials for the user on whose behalf the API key will be created. It is not possible to use this API to create an API key without that user's credentials. The supported user authentication credential types are:

• username and password
• Elasticsearch access tokens
• JWTs

The user, for whom the authentication credentials is provided, can optionally "run as" (impersonate) another user. In this case, the API key will be created on behalf of the impersonated user.

This API is intended be used by applications that need to create and manage API keys for end users, but cannot guarantee that those users have permission to create API keys on their own behalf. The API keys are created by the Elasticsearch API key service, which is automatically enabled.

A successful grant API key API call returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

By default, API keys never expire. You can specify expiration information when you create the API keys.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

grantApiKey

public final GrantApiKeyResponse grantApiKey(Function<GrantApiKeyRequest.Builder,ObjectBuilder<GrantApiKeyRequest>> fn)
                                      throws IOException,
ElasticsearchException

Grant an API key.

Create an API key on behalf of another user. This API is similar to the create API keys API, however it creates the API key for a user that is different than the user that runs the API. The caller must have authentication credentials for the user on whose behalf the API key will be created. It is not possible to use this API to create an API key without that user's credentials. The supported user authentication credential types are:

• username and password
• Elasticsearch access tokens
• JWTs

The user, for whom the authentication credentials is provided, can optionally "run as" (impersonate) another user. In this case, the API key will be created on behalf of the impersonated user.

This API is intended be used by applications that need to create and manage API keys for end users, but cannot guarantee that those users have permission to create API keys on their own behalf. The API keys are created by the Elasticsearch API key service, which is automatically enabled.

A successful grant API key API call returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds.

By default, API keys never expire. You can specify expiration information when you create the API keys.

Parameters:

fn - a function that initializes a builder to create the GrantApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

hasPrivileges

public HasPrivilegesResponse hasPrivileges(HasPrivilegesRequest request)
                                    throws IOException,
ElasticsearchException

Check user privileges.

Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

hasPrivileges

public final HasPrivilegesResponse hasPrivileges(Function<HasPrivilegesRequest.Builder,ObjectBuilder<HasPrivilegesRequest>> fn)
                                          throws IOException,
ElasticsearchException

Check user privileges.

Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.

Parameters:

fn - a function that initializes a builder to create the HasPrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

hasPrivileges

public HasPrivilegesResponse hasPrivileges()
                                    throws IOException,
ElasticsearchException

Check user privileges.

Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

hasPrivilegesUserProfile

public HasPrivilegesUserProfileResponse hasPrivilegesUserProfile(HasPrivilegesUserProfileRequest request)
                                                          throws IOException,
ElasticsearchException

Check user profile privileges.

Determine whether the users associated with the specified user profile IDs have all the requested privileges.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

hasPrivilegesUserProfile

public final HasPrivilegesUserProfileResponse hasPrivilegesUserProfile(Function<HasPrivilegesUserProfileRequest.Builder,ObjectBuilder<HasPrivilegesUserProfileRequest>> fn)
                                                                throws IOException,
ElasticsearchException

Check user profile privileges.

Determine whether the users associated with the specified user profile IDs have all the requested privileges.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Parameters:

fn - a function that initializes a builder to create the HasPrivilegesUserProfileRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateApiKey

public InvalidateApiKeyResponse invalidateApiKey(InvalidateApiKeyRequest request)
                                          throws IOException,
ElasticsearchException

Invalidate API keys.

This API invalidates API keys created by the create API key or grant API key APIs. Invalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.

To use this API, you must have at least the manage_security, manage_api_key, or manage_own_api_key cluster privileges. The manage_security privilege allows deleting any API key, including both REST and cross cluster API keys. The manage_api_key privilege allows deleting any REST API key, but not cross cluster API keys. The manage_own_api_key only allows deleting REST API keys that are owned by the user. In addition, with the manage_own_api_key privilege, an invalidation request must be issued in one of the three formats:

• Set the parameter owner=true.
• Or, set both username and realm_name to match the user's identity.
• Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the ids field.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateApiKey

public final InvalidateApiKeyResponse invalidateApiKey(Function<InvalidateApiKeyRequest.Builder,ObjectBuilder<InvalidateApiKeyRequest>> fn)
                                                throws IOException,
ElasticsearchException

Invalidate API keys.

This API invalidates API keys created by the create API key or grant API key APIs. Invalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.

To use this API, you must have at least the manage_security, manage_api_key, or manage_own_api_key cluster privileges. The manage_security privilege allows deleting any API key, including both REST and cross cluster API keys. The manage_api_key privilege allows deleting any REST API key, but not cross cluster API keys. The manage_own_api_key only allows deleting REST API keys that are owned by the user. In addition, with the manage_own_api_key privilege, an invalidation request must be issued in one of the three formats:

• Set the parameter owner=true.
• Or, set both username and realm_name to match the user's identity.
• Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the ids field.

Parameters:

fn - a function that initializes a builder to create the InvalidateApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateApiKey

public InvalidateApiKeyResponse invalidateApiKey()
                                          throws IOException,
ElasticsearchException

Invalidate API keys.

This API invalidates API keys created by the create API key or grant API key APIs. Invalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.

To use this API, you must have at least the manage_security, manage_api_key, or manage_own_api_key cluster privileges. The manage_security privilege allows deleting any API key, including both REST and cross cluster API keys. The manage_api_key privilege allows deleting any REST API key, but not cross cluster API keys. The manage_own_api_key only allows deleting REST API keys that are owned by the user. In addition, with the manage_own_api_key privilege, an invalidation request must be issued in one of the three formats:

• Set the parameter owner=true.
• Or, set both username and realm_name to match the user's identity.
• Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the ids field.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateToken

public InvalidateTokenResponse invalidateToken(InvalidateTokenRequest request)
                                        throws IOException,
ElasticsearchException

Invalidate a token.

The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the xpack.security.authc.token.timeout setting.

The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

NOTE: While all parameters are optional, at least one of them is required. More specifically, either one of token or refresh_token parameters is required. If none of these two are specified, then realm_name and/or username need to be specified.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateToken

public final InvalidateTokenResponse invalidateToken(Function<InvalidateTokenRequest.Builder,ObjectBuilder<InvalidateTokenRequest>> fn)
                                              throws IOException,
ElasticsearchException

Invalidate a token.

The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the xpack.security.authc.token.timeout setting.

The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

NOTE: While all parameters are optional, at least one of them is required. More specifically, either one of token or refresh_token parameters is required. If none of these two are specified, then realm_name and/or username need to be specified.

Parameters:

fn - a function that initializes a builder to create the InvalidateTokenRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

invalidateToken

public InvalidateTokenResponse invalidateToken()
                                        throws IOException,
ElasticsearchException

Invalidate a token.

The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the xpack.security.authc.token.timeout setting.

The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.

NOTE: While all parameters are optional, at least one of them is required. More specifically, either one of token or refresh_token parameters is required. If none of these two are specified, then realm_name and/or username need to be specified.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcAuthenticate

public OidcAuthenticateResponse oidcAuthenticate(OidcAuthenticateRequest request)
                                          throws IOException,
ElasticsearchException

Authenticate OpenID Connect.

Exchange an OpenID Connect authentication response message for an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcAuthenticate

public final OidcAuthenticateResponse oidcAuthenticate(Function<OidcAuthenticateRequest.Builder,ObjectBuilder<OidcAuthenticateRequest>> fn)
                                                throws IOException,
ElasticsearchException

Authenticate OpenID Connect.

Exchange an OpenID Connect authentication response message for an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Parameters:

fn - a function that initializes a builder to create the OidcAuthenticateRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcLogout

public OidcLogoutResponse oidcLogout(OidcLogoutRequest request)
                              throws IOException,
ElasticsearchException

Logout of OpenID Connect.

Invalidate an access token and a refresh token that were generated as a response to the /_security/oidc/authenticate API.

If the OpenID Connect authentication realm in Elasticsearch is accordingly configured, the response to this call will contain a URI pointing to the end session endpoint of the OpenID Connect Provider in order to perform single logout.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcLogout

public final OidcLogoutResponse oidcLogout(Function<OidcLogoutRequest.Builder,ObjectBuilder<OidcLogoutRequest>> fn)
                                    throws IOException,
ElasticsearchException

Logout of OpenID Connect.

Invalidate an access token and a refresh token that were generated as a response to the /_security/oidc/authenticate API.

If the OpenID Connect authentication realm in Elasticsearch is accordingly configured, the response to this call will contain a URI pointing to the end session endpoint of the OpenID Connect Provider in order to perform single logout.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Parameters:

fn - a function that initializes a builder to create the OidcLogoutRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcPrepareAuthentication

public OidcPrepareAuthenticationResponse oidcPrepareAuthentication(OidcPrepareAuthenticationRequest request)
                                                            throws IOException,
ElasticsearchException

Prepare OpenID connect authentication.

Create an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch.

The response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcPrepareAuthentication

public final OidcPrepareAuthenticationResponse oidcPrepareAuthentication(Function<OidcPrepareAuthenticationRequest.Builder,ObjectBuilder<OidcPrepareAuthenticationRequest>> fn)
                                                                  throws IOException,
ElasticsearchException

Prepare OpenID connect authentication.

Create an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch.

The response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Parameters:

fn - a function that initializes a builder to create the OidcPrepareAuthenticationRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

oidcPrepareAuthentication

public OidcPrepareAuthenticationResponse oidcPrepareAuthentication()
                                                            throws IOException,
ElasticsearchException

Prepare OpenID connect authentication.

Create an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch.

The response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process.

Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putPrivileges

public PutPrivilegesResponse putPrivileges(PutPrivilegesRequest request)
                                    throws IOException,
ElasticsearchException

Create or update application privileges.

To use this API, you must have one of the following privileges:

• The manage_security cluster privilege (or a greater privilege such as all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Application names are formed from a prefix, with an optional suffix that conform to the following rules:

• The prefix must begin with a lowercase ASCII letter.
• The prefix must contain only ASCII letters or digits.
• The prefix must be at least 3 characters long.
• If the suffix exists, it must begin with either a dash - or _.
• The suffix cannot contain any of the following characters: \, /, *, ?, ", <, >, |, ,, *.
• No part of the name can contain whitespace.

Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters _, -, and ..

Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: /, *, :.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putPrivileges

public final PutPrivilegesResponse putPrivileges(Function<PutPrivilegesRequest.Builder,ObjectBuilder<PutPrivilegesRequest>> fn)
                                          throws IOException,
ElasticsearchException

Create or update application privileges.

To use this API, you must have one of the following privileges:

• The manage_security cluster privilege (or a greater privilege such as all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Application names are formed from a prefix, with an optional suffix that conform to the following rules:

• The prefix must begin with a lowercase ASCII letter.
• The prefix must contain only ASCII letters or digits.
• The prefix must be at least 3 characters long.
• If the suffix exists, it must begin with either a dash - or _.
• The suffix cannot contain any of the following characters: \, /, *, ?, ", <, >, |, ,, *.
• No part of the name can contain whitespace.

Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters _, -, and ..

Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: /, *, :.

Parameters:

fn - a function that initializes a builder to create the PutPrivilegesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putPrivileges

public PutPrivilegesResponse putPrivileges()
                                    throws IOException,
ElasticsearchException

Create or update application privileges.

To use this API, you must have one of the following privileges:

• The manage_security cluster privilege (or a greater privilege such as all).
• The "Manage Application Privileges" global privilege for the application being referenced in the request.

Application names are formed from a prefix, with an optional suffix that conform to the following rules:

• The prefix must begin with a lowercase ASCII letter.
• The prefix must contain only ASCII letters or digits.
• The prefix must be at least 3 characters long.
• If the suffix exists, it must begin with either a dash - or _.
• The suffix cannot contain any of the following characters: \, /, *, ?, ", <, >, |, ,, *.
• No part of the name can contain whitespace.

Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters _, -, and ..

Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: /, *, :.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putRole

public PutRoleResponse putRole(PutRoleRequest request)
                        throws IOException,
ElasticsearchException

Create or update roles.

The role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management. The create or update roles API cannot update roles that are defined in roles files. File-based role management is not available in Elastic Serverless.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putRole

public final PutRoleResponse putRole(Function<PutRoleRequest.Builder,ObjectBuilder<PutRoleRequest>> fn)
                              throws IOException,
ElasticsearchException

Create or update roles.

The role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management. The create or update roles API cannot update roles that are defined in roles files. File-based role management is not available in Elastic Serverless.

Parameters:

fn - a function that initializes a builder to create the PutRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putRoleMapping

public PutRoleMappingResponse putRoleMapping(PutRoleMappingRequest request)
                                      throws IOException,
ElasticsearchException

Create or update role mappings.

Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files.

NOTE: This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using the create or update roles API or roles files.

Role templates

The most common use for role mappings is to create a mapping from a known value on the user to a fixed role name. For example, all users in the cn=admin,dc=example,dc=com LDAP group should be given the superuser role in Elasticsearch. The roles field is used for this purpose.

For more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user. The role_templates field is used for this purpose.

NOTE: To use role templates successfully, the relevant scripting feature must be enabled. Otherwise, all attempts to create a role mapping with role templates fail.

All of the user fields that are available in the role mapping rules are also available in the role templates. Thus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated.

By default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user. If the format of the template is set to "json" then the template is expected to produce a JSON string or an array of JSON strings for the role names.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putRoleMapping

public final PutRoleMappingResponse putRoleMapping(Function<PutRoleMappingRequest.Builder,ObjectBuilder<PutRoleMappingRequest>> fn)
                                            throws IOException,
ElasticsearchException

Create or update role mappings.

Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files.

NOTE: This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using the create or update roles API or roles files.

Role templates

The most common use for role mappings is to create a mapping from a known value on the user to a fixed role name. For example, all users in the cn=admin,dc=example,dc=com LDAP group should be given the superuser role in Elasticsearch. The roles field is used for this purpose.

For more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user. The role_templates field is used for this purpose.

NOTE: To use role templates successfully, the relevant scripting feature must be enabled. Otherwise, all attempts to create a role mapping with role templates fail.

All of the user fields that are available in the role mapping rules are also available in the role templates. Thus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated.

By default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user. If the format of the template is set to "json" then the template is expected to produce a JSON string or an array of JSON strings for the role names.

Parameters:

fn - a function that initializes a builder to create the PutRoleMappingRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putUser

public PutUserResponse putUser(PutUserRequest request)
                        throws IOException,
ElasticsearchException

Create or update users.

Add and update users in the native realm. A password is required for adding a new user but is optional when updating an existing user. To change a user's password without updating any other fields, use the change password API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

putUser

public final PutUserResponse putUser(Function<PutUserRequest.Builder,ObjectBuilder<PutUserRequest>> fn)
                              throws IOException,
ElasticsearchException

Create or update users.

Add and update users in the native realm. A password is required for adding a new user but is optional when updating an existing user. To change a user's password without updating any other fields, use the change password API.

Parameters:

fn - a function that initializes a builder to create the PutUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryApiKeys

public QueryApiKeysResponse queryApiKeys(QueryApiKeysRequest request)
                                  throws IOException,
ElasticsearchException

Find API keys with a query.

Get a paginated list of API keys and their information. You can optionally filter the results with a query.

To use this API, you must have at least the manage_own_api_key or the read_security cluster privileges. If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have the read_security, manage_api_key, or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryApiKeys

public final QueryApiKeysResponse queryApiKeys(Function<QueryApiKeysRequest.Builder,ObjectBuilder<QueryApiKeysRequest>> fn)
                                        throws IOException,
ElasticsearchException

Find API keys with a query.

Get a paginated list of API keys and their information. You can optionally filter the results with a query.

To use this API, you must have at least the manage_own_api_key or the read_security cluster privileges. If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have the read_security, manage_api_key, or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Parameters:

fn - a function that initializes a builder to create the QueryApiKeysRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryApiKeys

public QueryApiKeysResponse queryApiKeys()
                                  throws IOException,
ElasticsearchException

Find API keys with a query.

Get a paginated list of API keys and their information. You can optionally filter the results with a query.

To use this API, you must have at least the manage_own_api_key or the read_security cluster privileges. If you have only the manage_own_api_key privilege, this API returns only the API keys that you own. If you have the read_security, manage_api_key, or greater privileges (including manage_security), this API returns all API keys regardless of ownership.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryRole

public QueryRoleResponse queryRole(QueryRoleRequest request)
                            throws IOException,
ElasticsearchException

Find roles with a query.

Get roles in a paginated manner. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The query roles API does not retrieve roles that are defined in roles files, nor built-in ones. You can optionally filter the results with a query. Also, the results can be paginated and sorted.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryRole

public final QueryRoleResponse queryRole(Function<QueryRoleRequest.Builder,ObjectBuilder<QueryRoleRequest>> fn)
                                  throws IOException,
ElasticsearchException

Find roles with a query.

Get roles in a paginated manner. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The query roles API does not retrieve roles that are defined in roles files, nor built-in ones. You can optionally filter the results with a query. Also, the results can be paginated and sorted.

Parameters:

fn - a function that initializes a builder to create the QueryRoleRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryRole

public QueryRoleResponse queryRole()
                            throws IOException,
ElasticsearchException

Find roles with a query.

Get roles in a paginated manner. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The query roles API does not retrieve roles that are defined in roles files, nor built-in ones. You can optionally filter the results with a query. Also, the results can be paginated and sorted.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryUser

public QueryUserResponse queryUser(QueryUserRequest request)
                            throws IOException,
ElasticsearchException

Find users with a query.

Get information for users in a paginated manner. You can optionally filter the results with a query.

NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryUser

public final QueryUserResponse queryUser(Function<QueryUserRequest.Builder,ObjectBuilder<QueryUserRequest>> fn)
                                  throws IOException,
ElasticsearchException

Find users with a query.

Get information for users in a paginated manner. You can optionally filter the results with a query.

NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users.

Parameters:

fn - a function that initializes a builder to create the QueryUserRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

queryUser

public QueryUserResponse queryUser()
                            throws IOException,
ElasticsearchException

Find users with a query.

Get information for users in a paginated manner. You can optionally filter the results with a query.

NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlAuthenticate

public SamlAuthenticateResponse samlAuthenticate(SamlAuthenticateRequest request)
                                          throws IOException,
ElasticsearchException

Authenticate SAML.

Submit a SAML response message to Elasticsearch for consumption.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML message that is submitted can be:

• A response to a SAML authentication request that was previously created using the SAML prepare authentication API.
• An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow.

In either case, the SAML message needs to be a base64 encoded XML document with a root element of <Response>.

After successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication. This API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlAuthenticate

public final SamlAuthenticateResponse samlAuthenticate(Function<SamlAuthenticateRequest.Builder,ObjectBuilder<SamlAuthenticateRequest>> fn)
                                                throws IOException,
ElasticsearchException

Authenticate SAML.

Submit a SAML response message to Elasticsearch for consumption.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML message that is submitted can be:

• A response to a SAML authentication request that was previously created using the SAML prepare authentication API.
• An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow.

In either case, the SAML message needs to be a base64 encoded XML document with a root element of <Response>.

After successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication. This API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.

Parameters:

fn - a function that initializes a builder to create the SamlAuthenticateRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlCompleteLogout

public BooleanResponse samlCompleteLogout(SamlCompleteLogoutRequest request)
                                   throws IOException,
ElasticsearchException

Logout of SAML completely.

Verifies the logout response sent from the SAML IdP.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout. This API verifies the response by ensuring the content is relevant and validating its signature. An empty response is returned if the verification process is successful. The response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding. The caller of this API must prepare the request accordingly so that this API can handle either of them.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlCompleteLogout

public final BooleanResponse samlCompleteLogout(Function<SamlCompleteLogoutRequest.Builder,ObjectBuilder<SamlCompleteLogoutRequest>> fn)
                                         throws IOException,
ElasticsearchException

Logout of SAML completely.

Verifies the logout response sent from the SAML IdP.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout. This API verifies the response by ensuring the content is relevant and validating its signature. An empty response is returned if the verification process is successful. The response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding. The caller of this API must prepare the request accordingly so that this API can handle either of them.

Parameters:

fn - a function that initializes a builder to create the SamlCompleteLogoutRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlInvalidate

public SamlInvalidateResponse samlInvalidate(SamlInvalidateRequest request)
                                      throws IOException,
ElasticsearchException

Invalidate SAML.

Submit a SAML LogoutRequest message to Elasticsearch for consumption.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The logout request comes from the SAML IdP during an IdP initiated Single Logout. The custom web application can use this API to have Elasticsearch process the LogoutRequest. After successful validation of the request, Elasticsearch invalidates the access token and refresh token that corresponds to that specific SAML principal and provides a URL that contains a SAML LogoutResponse message. Thus the user can be redirected back to their IdP.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlInvalidate

public final SamlInvalidateResponse samlInvalidate(Function<SamlInvalidateRequest.Builder,ObjectBuilder<SamlInvalidateRequest>> fn)
                                            throws IOException,
ElasticsearchException

Invalidate SAML.

Submit a SAML LogoutRequest message to Elasticsearch for consumption.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The logout request comes from the SAML IdP during an IdP initiated Single Logout. The custom web application can use this API to have Elasticsearch process the LogoutRequest. After successful validation of the request, Elasticsearch invalidates the access token and refresh token that corresponds to that specific SAML principal and provides a URL that contains a SAML LogoutResponse message. Thus the user can be redirected back to their IdP.

Parameters:

fn - a function that initializes a builder to create the SamlInvalidateRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlLogout

public SamlLogoutResponse samlLogout(SamlLogoutRequest request)
                              throws IOException,
ElasticsearchException

Logout of SAML.

Submits a request to invalidate an access token and refresh token.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API invalidates the tokens that were generated for a user by the SAML authenticate API. If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlLogout

public final SamlLogoutResponse samlLogout(Function<SamlLogoutRequest.Builder,ObjectBuilder<SamlLogoutRequest>> fn)
                                    throws IOException,
ElasticsearchException

Logout of SAML.

Submits a request to invalidate an access token and refresh token.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API invalidates the tokens that were generated for a user by the SAML authenticate API. If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).

Parameters:

fn - a function that initializes a builder to create the SamlLogoutRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlPrepareAuthentication

public SamlPrepareAuthenticationResponse samlPrepareAuthentication(SamlPrepareAuthenticationRequest request)
                                                            throws IOException,
ElasticsearchException

Prepare SAML authentication.

Create a SAML authentication request (<AuthnRequest>) as a URL string based on the configuration of the respective SAML realm in Elasticsearch.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API returns a URL pointing to the SAML Identity Provider. You can use the URL to redirect the browser of the user in order to continue the authentication process. The URL includes a single parameter named SAMLRequest, which contains a SAML Authentication request that is deflated and Base64 encoded. If the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named SigAlg and Signature. These parameters contain the algorithm used for the signature and the signature value itself. It also returns a random string that uniquely identifies this SAML Authentication request. The caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlPrepareAuthentication

public final SamlPrepareAuthenticationResponse samlPrepareAuthentication(Function<SamlPrepareAuthenticationRequest.Builder,ObjectBuilder<SamlPrepareAuthenticationRequest>> fn)
                                                                  throws IOException,
ElasticsearchException

Prepare SAML authentication.

Create a SAML authentication request (<AuthnRequest>) as a URL string based on the configuration of the respective SAML realm in Elasticsearch.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API returns a URL pointing to the SAML Identity Provider. You can use the URL to redirect the browser of the user in order to continue the authentication process. The URL includes a single parameter named SAMLRequest, which contains a SAML Authentication request that is deflated and Base64 encoded. If the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named SigAlg and Signature. These parameters contain the algorithm used for the signature and the signature value itself. It also returns a random string that uniquely identifies this SAML Authentication request. The caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.

Parameters:

fn - a function that initializes a builder to create the SamlPrepareAuthenticationRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlPrepareAuthentication

public SamlPrepareAuthenticationResponse samlPrepareAuthentication()
                                                            throws IOException,
ElasticsearchException

Prepare SAML authentication.

Create a SAML authentication request (<AuthnRequest>) as a URL string based on the configuration of the respective SAML realm in Elasticsearch.

NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

This API returns a URL pointing to the SAML Identity Provider. You can use the URL to redirect the browser of the user in order to continue the authentication process. The URL includes a single parameter named SAMLRequest, which contains a SAML Authentication request that is deflated and Base64 encoded. If the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named SigAlg and Signature. These parameters contain the algorithm used for the signature and the signature value itself. It also returns a random string that uniquely identifies this SAML Authentication request. The caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlServiceProviderMetadata

public SamlServiceProviderMetadataResponse samlServiceProviderMetadata(SamlServiceProviderMetadataRequest request)
                                                                throws IOException,
ElasticsearchException

Create SAML service provider metadata.

Generate SAML metadata for a SAML 2.0 Service Provider.

The SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file. This API generates Service Provider metadata based on the configuration of a SAML realm in Elasticsearch.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

samlServiceProviderMetadata

public final SamlServiceProviderMetadataResponse samlServiceProviderMetadata(Function<SamlServiceProviderMetadataRequest.Builder,ObjectBuilder<SamlServiceProviderMetadataRequest>> fn)
                                                                      throws IOException,
ElasticsearchException

Create SAML service provider metadata.

Generate SAML metadata for a SAML 2.0 Service Provider.

The SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file. This API generates Service Provider metadata based on the configuration of a SAML realm in Elasticsearch.

Parameters:

fn - a function that initializes a builder to create the SamlServiceProviderMetadataRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

suggestUserProfiles

public SuggestUserProfilesResponse suggestUserProfiles(SuggestUserProfilesRequest request)
                                                throws IOException,
ElasticsearchException

Suggest a user profile.

Get suggestions for user profiles that match specified search criteria.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

suggestUserProfiles

public final SuggestUserProfilesResponse suggestUserProfiles(Function<SuggestUserProfilesRequest.Builder,ObjectBuilder<SuggestUserProfilesRequest>> fn)
                                                      throws IOException,
ElasticsearchException

Suggest a user profile.

Get suggestions for user profiles that match specified search criteria.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Parameters:

fn - a function that initializes a builder to create the SuggestUserProfilesRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

suggestUserProfiles

public SuggestUserProfilesResponse suggestUserProfiles()
                                                throws IOException,
ElasticsearchException

Suggest a user profile.

Get suggestions for user profiles that match specified search criteria.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateApiKey

public UpdateApiKeyResponse updateApiKey(UpdateApiKeyRequest request)
                                  throws IOException,
ElasticsearchException

Update an API key.

Update attributes of an existing API key. This API supports updates to an API key's access scope, expiration, and metadata.

To use this API, you must have at least the manage_own_api_key cluster privilege. Users can only update API keys that they created or that were granted to them. To update another user’s API key, use the run_as feature to submit a request on behalf of another user.

IMPORTANT: It's not possible to use an API key as the authentication credential for this API. The owner user’s credentials are required.

Use this API to update API keys created by the create API key or grant API Key APIs. If you need to apply the same update to many API keys, you can use the bulk update API keys API to reduce overhead. It's not possible to update expired API keys or API keys that have been invalidated by the invalidate API key API.

The access scope of an API key is derived from the role_descriptors you specify in the request and a snapshot of the owner user's permissions at the time of the request. The snapshot of the owner's permissions is updated automatically on every call.

IMPORTANT: If you don't specify role_descriptors in the request, a call to this API might still change the API key's access scope. This change can occur if the owner user's permissions have changed since the API key was created or last modified.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateApiKey

public final UpdateApiKeyResponse updateApiKey(Function<UpdateApiKeyRequest.Builder,ObjectBuilder<UpdateApiKeyRequest>> fn)
                                        throws IOException,
ElasticsearchException

Update an API key.

Update attributes of an existing API key. This API supports updates to an API key's access scope, expiration, and metadata.

To use this API, you must have at least the manage_own_api_key cluster privilege. Users can only update API keys that they created or that were granted to them. To update another user’s API key, use the run_as feature to submit a request on behalf of another user.

IMPORTANT: It's not possible to use an API key as the authentication credential for this API. The owner user’s credentials are required.

Use this API to update API keys created by the create API key or grant API Key APIs. If you need to apply the same update to many API keys, you can use the bulk update API keys API to reduce overhead. It's not possible to update expired API keys or API keys that have been invalidated by the invalidate API key API.

The access scope of an API key is derived from the role_descriptors you specify in the request and a snapshot of the owner user's permissions at the time of the request. The snapshot of the owner's permissions is updated automatically on every call.

IMPORTANT: If you don't specify role_descriptors in the request, a call to this API might still change the API key's access scope. This change can occur if the owner user's permissions have changed since the API key was created or last modified.

Parameters:

fn - a function that initializes a builder to create the UpdateApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateCrossClusterApiKey

public UpdateCrossClusterApiKeyResponse updateCrossClusterApiKey(UpdateCrossClusterApiKeyRequest request)
                                                          throws IOException,
ElasticsearchException

Update a cross-cluster API key.

Update the attributes of an existing cross-cluster API key, which is used for API key based remote cluster access.

To use this API, you must have at least the manage_security cluster privilege. Users can only update API keys that they created. To update another user's API key, use the run_as feature to submit a request on behalf of another user.

IMPORTANT: It's not possible to use an API key as the authentication credential for this API. To update an API key, the owner user's credentials are required.

It's not possible to update expired API keys, or API keys that have been invalidated by the invalidate API key API.

This API supports updates to an API key's access scope, metadata, and expiration. The owner user's information, such as the username and realm, is also updated automatically on every call.

NOTE: This API cannot update REST API keys, which should be updated by either the update API key or bulk update API keys API.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateCrossClusterApiKey

public final UpdateCrossClusterApiKeyResponse updateCrossClusterApiKey(Function<UpdateCrossClusterApiKeyRequest.Builder,ObjectBuilder<UpdateCrossClusterApiKeyRequest>> fn)
                                                                throws IOException,
ElasticsearchException

Update a cross-cluster API key.

Update the attributes of an existing cross-cluster API key, which is used for API key based remote cluster access.

To use this API, you must have at least the manage_security cluster privilege. Users can only update API keys that they created. To update another user's API key, use the run_as feature to submit a request on behalf of another user.

IMPORTANT: It's not possible to use an API key as the authentication credential for this API. To update an API key, the owner user's credentials are required.

It's not possible to update expired API keys, or API keys that have been invalidated by the invalidate API key API.

This API supports updates to an API key's access scope, metadata, and expiration. The owner user's information, such as the username and realm, is also updated automatically on every call.

NOTE: This API cannot update REST API keys, which should be updated by either the update API key or bulk update API keys API.

Parameters:

fn - a function that initializes a builder to create the UpdateCrossClusterApiKeyRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateSettings

public UpdateSettingsResponse updateSettings(UpdateSettingsRequest request)
                                      throws IOException,
ElasticsearchException

Update security index settings.

Update the user-configurable settings for the security internal index (.security and associated indices). Only a subset of settings are allowed to be modified. This includes index.auto_expand_replicas and index.number_of_replicas.

NOTE: If index.auto_expand_replicas is set, index.number_of_replicas will be ignored during updates.

If a specific index is not in use on the system and settings are provided for it, the request will be rejected. This API does not yet support configuring the settings for indices before they are in use.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateSettings

public final UpdateSettingsResponse updateSettings(Function<UpdateSettingsRequest.Builder,ObjectBuilder<UpdateSettingsRequest>> fn)
                                            throws IOException,
ElasticsearchException

Update security index settings.

Update the user-configurable settings for the security internal index (.security and associated indices). Only a subset of settings are allowed to be modified. This includes index.auto_expand_replicas and index.number_of_replicas.

NOTE: If index.auto_expand_replicas is set, index.number_of_replicas will be ignored during updates.

If a specific index is not in use on the system and settings are provided for it, the request will be rejected. This API does not yet support configuring the settings for indices before they are in use.

Parameters:

fn - a function that initializes a builder to create the UpdateSettingsRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateSettings

public UpdateSettingsResponse updateSettings()
                                      throws IOException,
ElasticsearchException

Update security index settings.

Update the user-configurable settings for the security internal index (.security and associated indices). Only a subset of settings are allowed to be modified. This includes index.auto_expand_replicas and index.number_of_replicas.

NOTE: If index.auto_expand_replicas is set, index.number_of_replicas will be ignored during updates.

If a specific index is not in use on the system and settings are provided for it, the request will be rejected. This API does not yet support configuring the settings for indices before they are in use.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateUserProfileData

public UpdateUserProfileDataResponse updateUserProfileData(UpdateUserProfileDataRequest request)
                                                    throws IOException,
ElasticsearchException

Update user profile data.

Update specific data for the user profile that is associated with a unique ID.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

To use this API, you must have one of the following privileges:

• The manage_user_profile cluster privilege.
• The update_profile_data global privilege for the namespaces that are referenced in the request.

This API updates the labels and data fields of an existing user profile document with JSON objects. New keys and their values are added to the profile document and conflicting keys are replaced by data that's included in the request.

For both labels and data, content is namespaced by the top-level fields. The update_profile_data global privilege grants privileges for updating only the allowed namespaces.

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co

updateUserProfileData

public final UpdateUserProfileDataResponse updateUserProfileData(Function<UpdateUserProfileDataRequest.Builder,ObjectBuilder<UpdateUserProfileDataRequest>> fn)
                                                          throws IOException,
ElasticsearchException

Update user profile data.

Update specific data for the user profile that is associated with a unique ID.

NOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice.

To use this API, you must have one of the following privileges:

• The manage_user_profile cluster privilege.
• The update_profile_data global privilege for the namespaces that are referenced in the request.

This API updates the labels and data fields of an existing user profile document with JSON objects. New keys and their values are added to the profile document and conflicting keys are replaced by data that's included in the request.

For both labels and data, content is namespaced by the top-level fields. The update_profile_data global privilege grants privileges for updating only the allowed namespaces.

Parameters:

fn - a function that initializes a builder to create the UpdateUserProfileDataRequest

Throws:

IOException

ElasticsearchException

See Also:

• Documentation on elastic.co