› › ›

Role restriction

Role restriction can be used to specify conditions under which a role should be effective. When conditions are not met, the role will be disabled, which will result in access being denied. Not specifying restriction means the role is not restricted and thus always effective. This is the default behaviour.

Currently, the role restriction is only supported for API keys, with limitation that the API key can only have a single role descriptor.

Workflows

Workflows allow to restrict the role to be effective exclusively when calling certain REST APIs. Calling a REST API that is not allowed by a workflow, will result in the role being disabled. The below section lists workflows that you can restrict the role to:

search_application_query: This workflow restricts the role to the Search Application Search API only.

Workflow names are case-sensitive.

Examples

The following example creates an API key with a restriction to the search_application_query workflow, which allows to call only Search Application Search API:

resp = client.security.create_api_key(
    name="my-restricted-api-key",
    role_descriptors={
        "my-restricted-role-descriptor": {
            "indices": [
                {
                    "names": [
                        "my-search-app"
                    ],
                    "privileges": [
                        "read"
                    ]
                }
            ],
            "restriction": {
                "workflows": [
                    "search_application_query"
                ]
            }
        }
    },
)
print(resp)

const response = await client.security.createApiKey({
  name: "my-restricted-api-key",
  role_descriptors: {
    "my-restricted-role-descriptor": {
      indices: [
        {
          names: ["my-search-app"],
          privileges: ["read"],
        },
      ],
      restriction: {
        workflows: ["search_application_query"],
      },
    },
  },
});
console.log(response);

POST /_security/api_key
{
  "name": "my-restricted-api-key",
  "role_descriptors": {
    "my-restricted-role-descriptor": {
      "indices": [
        {
          "names": ["my-search-app"],
          "privileges": ["read"]
        }
      ],
      "restriction":  {
        "workflows": ["search_application_query"]
      }
    }
  }
}

© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/role-restriction.html