Type to search.

Clone an API key

  • POST also PUT /_security/api_key/clone
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental since 9.4 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Create a copy of an existing API key with a new ID. The cloned key inherits the role descriptors of the source key. This is intended for applications (such as Kibana) that need to create API keys on behalf of a user using an existing API key credential, since derived API keys (API keys created by API keys) are not otherwise supported.

Required privileges

Cluster privileges clone_api_key

Query parameters

refresh enum

If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.

Values: true false wait_for

Request body

api_key string required

The credentials of the API key to clone. This is the secret value returned when the key was originally created.

name string

A name for the cloned API key. If not provided, the name of the source key is used.

expiration string

The expiration time for the cloned API key. By default, API keys never expire. Set to null to explicitly create a key with no expiration.

metadata object

Arbitrary metadata to associate with the cloned API key. It supports nested data structure. Within the metadata object, keys beginning with _ are reserved for system usage.

Response

application/json
api_key string required

The generated API key value for the cloned key.

expiration number

Expiration in milliseconds for the API key.

id string required

The unique ID of the cloned API key.

name string required

The name of the cloned API key.

encoded string required

API key credentials which is the base64-encoding of the UTF-8 representation of id and api_key joined by a colon (:).