AuthThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityPlannedWe plan to add this functionality in a future Elastic Stack update. Subject to changes.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Create a service account in a namespace of your own, or replace one that already exists.
A replacement is not a partial update: every write applies the defaults, so an account that was disabled and is then written again without enabled comes back enabled.
Creating an account whose name still has leftover service tokens is rejected.
Delete those tokens first.
Note
The elastic namespace is reserved for the built-in service accounts that ship with Elasticsearch.
The manage_service_account privilege does not authorize this API.
The namespace, which is a top-level grouping of service accounts.
It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters.
It cannot be elastic, which is reserved for built-in service accounts.
servicestringrequired
The service name.
It must start with a letter or digit and can contain only letters, digits, hyphens, and underscores, up to a maximum of 128 characters.
If wait_for (the default) then wait for a refresh to make this operation visible to search, if true then refresh the affected shards to make this operation visible to search, if false then do nothing with refreshes.
The names of the roles to grant to the service account, up to a maximum of 1000.
The roles are resolved when the account authenticates, so they do not have to exist yet.
enabledboolean · default: true
Whether the account can authenticate.
Tokens can still be created for a disabled account; they just cannot be used until the account is enabled.
descriptionstring
A free-text description of the account, as sent on the last PUT of the account.
It has no meaning to Elasticsearch. Absent when the account has no description.
A successful call returns a JSON structure that shows whether the service account has been created or updated.
When an existing service account is replaced, created is set to false.