@elastic/schemas 0.5.1 → 0.6.0

package/lib/es/json/security.get_token.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_token", "description": "Get a token.\n\nCreate a bearer token for access without requiring basic authentication.\nThe tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface.\nAlternatively, you can explicitly enable the `xpack.security.authc.token.enabled` setting.\nWhen you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface.\n\nThe get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body.\n\nA successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available.\n\nThe tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used.\nThat time period is defined by the `xpack.security.authc.token.timeout` setting.\nIf you want to invalidate a token immediately, you can do so by using the invalidate token API.", "x-api": { "id": "security.get_token", "name": "get-token", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oauth2/token", "x-urls": [{ "path": "/_security/oauth2/token", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "grant_type": { "$ref": "./security.get_token.json#/$defs/security.get_token__AccessTokenGrantType", "description": "The type of grant.\nSupported grant types are: `password`, `_kerberos`, `client_credentials`, and `refresh_token`.", "x-found-in": "body" }, "scope": { "type": "string", "description": "The scope of the token.\nCurrently tokens are only issued for a scope of FULL regardless of the value sent with the request.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nIf you specify the `password` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "kerberos_ticket": { "type": "string", "description": "The base64 encoded kerberos ticket.\nIf you specify the `_kerberos` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The string that was returned when you created the token, which enables you to extend its life.\nIf you specify the `refresh_token` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username that identifies the user.\nIf you specify the `password` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_token", "description": "Get a token.\n\nCreate a bearer token for access without requiring basic authentication.\nThe tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface.\nAlternatively, you can explicitly enable the `xpack.security.authc.token.enabled` setting.\nWhen you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface.\n\nThe get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body.\n\nA successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available.\n\nThe tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used.\nThat time period is defined by the `xpack.security.authc.token.timeout` setting.\nIf you want to invalidate a token immediately, you can do so by using the invalidate token API.", "x-api": { "id": "security.get_token", "name": "get-token", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oauth2/token", "x-urls": [{ "path": "/_security/oauth2/token", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "grant_type": { "$ref": "./security.get_token.json#/$defs/security.get_token__AccessTokenGrantType", "description": "The type of grant.\nSupported grant types are: `password`, `_kerberos`, `client_credentials`, and `refresh_token`.", "x-found-in": "body" }, "scope": { "type": "string", "description": "The scope of the token.\nCurrently tokens are only issued for a scope of FULL regardless of the value sent with the request.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nIf you specify the `password` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "kerberos_ticket": { "type": "string", "description": "The base64 encoded kerberos ticket.\nIf you specify the `_kerberos` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The string that was returned when you created the token, which enables you to extend its life.\nIf you specify the `refresh_token` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username that identifies the user.\nIf you specify the `password` grant type, this parameter is required.\nThis parameter is not valid with any other supported grant type.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.get_user.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user", "description": "Get users.\n\nGet information about users in the native realm and built-in users.", "x-api": { "id": "security.get_user", "name": "get-user", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/{username}", "x-urls": [{ "path": "/_security/user/{username}", "methods": ["GET"] }, { "path": "/_security/user", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "stability": "stable" } }, "type": "object", "properties": { "with_profile_uid": { "type": "boolean", "description": "Determines whether to retrieve the user profile UID, if it exists, for the users.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.5.0" }, "serverless": {} } }, "username": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "An identifier for the user. You can specify multiple usernames as a comma-separated list. If you omit this parameter, the API retrieves information about all users.", "x-found-in": "path" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user", "description": "Get users.\n\nGet information about users in the native realm and built-in users.", "x-api": { "id": "security.get_user", "name": "get-user", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/{username}", "x-urls": [{ "path": "/_security/user/{username}", "methods": ["GET"] }, { "path": "/_security/user", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "stability": "stable" } }, "type": "object", "properties": { "with_profile_uid": { "type": "boolean", "description": "Determines whether to retrieve the user profile UID, if it exists, for the users.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.5.0" }, "serverless": {} } }, "username": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "An identifier for the user. You can specify multiple usernames as a comma-separated list. If you omit this parameter, the API retrieves information about all users.", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.get_user_privileges.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user_privileges", "description": "Get user privileges.\n\nGet the security privileges for the logged in user.\nAll users can use this API, but only to determine their own privileges.\nTo check the privileges of other users, you must use the run as feature.\nTo check whether a user has a specific list of privileges, use the has privileges API.", "x-api": { "id": "security.get_user_privileges", "name": "get-user-privileges", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/_privileges", "x-urls": [{ "path": "/_security/user/_privileges", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "6.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": {} }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user_privileges", "description": "Get user privileges.\n\nGet the security privileges for the logged in user.\nAll users can use this API, but only to determine their own privileges.\nTo check the privileges of other users, you must use the run as feature.\nTo check whether a user has a specific list of privileges, use the has privileges API.", "x-api": { "id": "security.get_user_privileges", "name": "get-user-privileges", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/_privileges", "x-urls": [{ "path": "/_security/user/_privileges", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "6.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.get_user_profile.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user_profile", "description": "Get a user profile.\n\nGet a user's profile using the unique profile ID.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions.\nIndividual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.get_user_profile", "name": "get-user-profile", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/{uid}", "x-urls": [{ "path": "/_security/profile/{uid}", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.2.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "data": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A comma-separated list of filters for the `data` field of the profile document.\nTo return all content use `data=*`.\nTo return a subset of content use `data=<key>` to retrieve content nested under the specified `<key>`.\nBy default returns no `data` content.", "x-found-in": "query" }, "uid": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A unique identifier for the user profile.", "x-found-in": "path" } }, "required": ["uid"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.get_user_profile", "description": "Get a user profile.\n\nGet a user's profile using the unique profile ID.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions.\nIndividual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.get_user_profile", "name": "get-user-profile", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/{uid}", "x-urls": [{ "path": "/_security/profile/{uid}", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.2.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "data": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A comma-separated list of filters for the `data` field of the profile document.\nTo return all content use `data=*`.\nTo return a subset of content use `data=<key>` to retrieve content nested under the specified `<key>`.\nBy default returns no `data` content.", "x-found-in": "query" }, "uid": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A unique identifier for the user profile.", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["uid"] }

package/lib/es/json/security.grant_api_key.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.grant_api_key", "description": "Grant an API key.\n\nCreate an API key on behalf of another user.\nThis API is similar to the create API keys API, however it creates the API key for a user that is different than the user that runs the API.\nThe caller must have authentication credentials for the user on whose behalf the API key will be created.\nIt is not possible to use this API to create an API key without that user's credentials.\nThe supported user authentication credential types are:\n\n* username and password\n* Elasticsearch access tokens\n* JWTs\n\nThe user, for whom the authentication credentials is provided, can optionally \"run as\" (impersonate) another user.\nIn this case, the API key will be created on behalf of the impersonated user.\n\nThis API is intended be used by applications that need to create and manage API keys for end users, but cannot guarantee that those users have permission to create API keys on their own behalf.\nThe API keys are created by the Elasticsearch API key service, which is automatically enabled.\n\nA successful grant API key API call returns a JSON structure that contains the API key, its unique id, and its name.\nIf applicable, it also returns expiration information for the API key in milliseconds.\n\nBy default, API keys never expire. You can specify expiration information when you create the API keys.", "x-api": { "id": "security.grant_api_key", "name": "grant-api-key", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/api_key/grant", "x-urls": [{ "path": "/_security/api_key/grant", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.9.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If 'true', Elasticsearch refreshes the affected shards to make this operation\nvisible to search.\nIf 'wait_for', it waits for a refresh to make this operation visible to search.\nIf 'false', nothing is done with refreshes.", "x-found-in": "query" }, "api_key": { "$ref": "./security.grant_api_key.json#/$defs/security.grant_api_key__GrantApiKey", "description": "The API key.", "x-found-in": "body" }, "grant_type": { "$ref": "./security.grant_api_key.json#/$defs/security.grant_api_key__ApiKeyGrantType", "description": "The type of grant. Supported grant types are: `access_token`, `password`.", "x-found-in": "body" }, "access_token": { "type": "string", "description": "The user's access token.\nIf you specify the `access_token` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "username": { "type": "string", "description": "The user name that identifies the user.\nIf you specify the `password` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nIf you specify the `password` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "run_as": { "type": "string", "description": "The name of the user to be impersonated.", "x-found-in": "body" } }, "required": ["api_key", "grant_type"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.grant_api_key", "description": "Grant an API key.\n\nCreate an API key on behalf of another user.\nThis API is similar to the create API keys API, however it creates the API key for a user that is different than the user that runs the API.\nThe caller must have authentication credentials for the user on whose behalf the API key will be created.\nIt is not possible to use this API to create an API key without that user's credentials.\nThe supported user authentication credential types are:\n\n* username and password\n* Elasticsearch access tokens\n* JWTs\n\nThe user, for whom the authentication credentials is provided, can optionally \"run as\" (impersonate) another user.\nIn this case, the API key will be created on behalf of the impersonated user.\n\nThis API is intended be used by applications that need to create and manage API keys for end users, but cannot guarantee that those users have permission to create API keys on their own behalf.\nThe API keys are created by the Elasticsearch API key service, which is automatically enabled.\n\nA successful grant API key API call returns a JSON structure that contains the API key, its unique id, and its name.\nIf applicable, it also returns expiration information for the API key in milliseconds.\n\nBy default, API keys never expire. You can specify expiration information when you create the API keys.", "x-api": { "id": "security.grant_api_key", "name": "grant-api-key", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/api_key/grant", "x-urls": [{ "path": "/_security/api_key/grant", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.9.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If 'true', Elasticsearch refreshes the affected shards to make this operation\nvisible to search.\nIf 'wait_for', it waits for a refresh to make this operation visible to search.\nIf 'false', nothing is done with refreshes.", "x-found-in": "query" }, "api_key": { "$ref": "./security.grant_api_key.json#/$defs/security.grant_api_key__GrantApiKey", "description": "The API key.", "x-found-in": "body" }, "grant_type": { "$ref": "./security.grant_api_key.json#/$defs/security.grant_api_key__ApiKeyGrantType", "description": "The type of grant. Supported grant types are: `access_token`, `password`.", "x-found-in": "body" }, "access_token": { "type": "string", "description": "The user's access token.\nIf you specify the `access_token` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "username": { "type": "string", "description": "The user name that identifies the user.\nIf you specify the `password` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nIf you specify the `password` grant type, this parameter is required.\nIt is not valid with other grant types.", "x-found-in": "body" }, "run_as": { "type": "string", "description": "The name of the user to be impersonated.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["api_key", "grant_type"] }

package/lib/es/json/security.has_privileges.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.has_privileges", "description": "Check user privileges.\n\nDetermine whether the specified user has a specified list of privileges.\nAll users can use this API, but only to determine their own privileges.\nTo check the privileges of other users, you must use the run as feature.", "x-api": { "id": "security.has_privileges", "name": "has-privileges", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/{user}/_has_privileges", "x-urls": [{ "path": "/_security/user/_has_privileges", "methods": ["GET", "POST"] }, { "path": "/_security/user/{user}/_has_privileges", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "6.4.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "application": { "type": "array", "items": { "$ref": "./security.has_privileges.json#/$defs/security.has_privileges__ApplicationPrivilegesCheck" }, "x-found-in": "body" }, "cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ClusterPrivilege" }, "description": "A list of the cluster privileges that you want to check.", "x-found-in": "body" }, "index": { "type": "array", "items": { "$ref": "./security.has_privileges.json#/$defs/security.has_privileges__IndexPrivilegesCheck" }, "x-found-in": "body" }, "user": { "type": "string", "description": "Username", "x-found-in": "path" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.has_privileges", "description": "Check user privileges.\n\nDetermine whether the specified user has a specified list of privileges.\nAll users can use this API, but only to determine their own privileges.\nTo check the privileges of other users, you must use the run as feature.", "x-api": { "id": "security.has_privileges", "name": "has-privileges", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/user/{user}/_has_privileges", "x-urls": [{ "path": "/_security/user/_has_privileges", "methods": ["GET", "POST"] }, { "path": "/_security/user/{user}/_has_privileges", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "6.4.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "application": { "type": "array", "items": { "$ref": "./security.has_privileges.json#/$defs/security.has_privileges__ApplicationPrivilegesCheck" }, "x-found-in": "body" }, "cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ClusterPrivilege" }, "description": "A list of the cluster privileges that you want to check.", "x-found-in": "body" }, "index": { "type": "array", "items": { "$ref": "./security.has_privileges.json#/$defs/security.has_privileges__IndexPrivilegesCheck" }, "x-found-in": "body" }, "user": { "type": "string", "description": "Username", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.has_privileges_user_profile.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.has_privileges_user_profile", "description": "Check user profile privileges.\n\nDetermine whether the users associated with the specified user profile IDs have all the requested privileges.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.has_privileges_user_profile", "name": "has-privileges-user-profile", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/_has_privileges", "x-urls": [{ "path": "/_security/profile/_has_privileges", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.3.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "uids": { "type": "array", "items": { "type": "string" }, "description": "A list of profile IDs. The privileges are checked for associated users of the profiles.", "x-found-in": "body" }, "privileges": { "$ref": "./security.has_privileges_user_profile.json#/$defs/security.has_privileges_user_profile__PrivilegesCheck", "description": "An object containing all the privileges to be checked.", "x-found-in": "body" } }, "required": ["uids", "privileges"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.has_privileges_user_profile", "description": "Check user profile privileges.\n\nDetermine whether the users associated with the specified user profile IDs have all the requested privileges.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.has_privileges_user_profile", "name": "has-privileges-user-profile", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/_has_privileges", "x-urls": [{ "path": "/_security/profile/_has_privileges", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.3.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "uids": { "type": "array", "items": { "type": "string" }, "description": "A list of profile IDs. The privileges are checked for associated users of the profiles.", "x-found-in": "body" }, "privileges": { "$ref": "./security.has_privileges_user_profile.json#/$defs/security.has_privileges_user_profile__PrivilegesCheck", "description": "An object containing all the privileges to be checked.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["uids", "privileges"] }

package/lib/es/json/security.invalidate_api_key.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.invalidate_api_key", "description": "Invalidate API keys.\n\nThis API invalidates API keys created by the create API key or grant API key APIs.\nInvalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.\n\nTo use this API, you must have at least the `manage_security`, `manage_api_key`, or `manage_own_api_key` cluster privileges.\nThe `manage_security` privilege allows deleting any API key, including both REST and cross cluster API keys.\nThe `manage_api_key` privilege allows deleting any REST API key, but not cross cluster API keys.\nThe `manage_own_api_key` only allows deleting REST API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user's identity.\n- Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field.", "x-api": { "id": "security.invalidate_api_key", "name": "invalidate-api-key", "namespace": "security" }, "x-method": "DELETE", "x-path": "/_security/api_key", "x-urls": [{ "path": "/_security/api_key", "methods": ["DELETE"] }], "x-destructive": true, "x-availability": { "stack": { "since": "6.7.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "id": { "type": "string", "x-found-in": "body" }, "ids": { "type": "array", "items": { "type": "string" }, "description": "A list of API key ids.\nThis parameter cannot be used with any of `name`, `realm_name`, or `username`.", "x-found-in": "body" }, "name": { "type": "string", "description": "An API key name.\nThis parameter cannot be used with any of `ids`, `realm_name` or `username`.", "x-found-in": "body" }, "owner": { "type": "boolean", "description": "Query API keys owned by the currently authenticated user.\nThe `realm_name` or `username` parameters cannot be specified when this parameter is set to `true` as they are assumed to be the currently authenticated ones.\n\nNOTE: At least one of `ids`, `name`, `username`, and `realm_name` must be specified if `owner` is `false`.", "x-found-in": "body" }, "realm_name": { "type": "string", "description": "The name of an authentication realm.\nThis parameter cannot be used with either `ids` or `name`, or when `owner` flag is set to `true`.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username of a user.\nThis parameter cannot be used with either `ids` or `name` or when `owner` flag is set to `true`.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.invalidate_api_key", "description": "Invalidate API keys.\n\nThis API invalidates API keys created by the create API key or grant API key APIs.\nInvalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted.\n\nTo use this API, you must have at least the `manage_security`, `manage_api_key`, or `manage_own_api_key` cluster privileges.\nThe `manage_security` privilege allows deleting any API key, including both REST and cross cluster API keys.\nThe `manage_api_key` privilege allows deleting any REST API key, but not cross cluster API keys.\nThe `manage_own_api_key` only allows deleting REST API keys that are owned by the user.\nIn addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats:\n\n- Set the parameter `owner=true`.\n- Or, set both `username` and `realm_name` to match the user's identity.\n- Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field.", "x-api": { "id": "security.invalidate_api_key", "name": "invalidate-api-key", "namespace": "security" }, "x-method": "DELETE", "x-path": "/_security/api_key", "x-urls": [{ "path": "/_security/api_key", "methods": ["DELETE"] }], "x-destructive": true, "x-availability": { "stack": { "since": "6.7.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "id": { "type": "string", "x-found-in": "body" }, "ids": { "type": "array", "items": { "type": "string" }, "description": "A list of API key ids.\nThis parameter cannot be used with any of `name`, `realm_name`, or `username`.", "x-found-in": "body" }, "name": { "type": "string", "description": "An API key name.\nThis parameter cannot be used with any of `ids`, `realm_name` or `username`.", "x-found-in": "body" }, "owner": { "type": "boolean", "description": "Query API keys owned by the currently authenticated user.\nThe `realm_name` or `username` parameters cannot be specified when this parameter is set to `true` as they are assumed to be the currently authenticated ones.\n\nNOTE: At least one of `ids`, `name`, `username`, and `realm_name` must be specified if `owner` is `false`.", "x-found-in": "body" }, "realm_name": { "type": "string", "description": "The name of an authentication realm.\nThis parameter cannot be used with either `ids` or `name`, or when `owner` flag is set to `true`.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username of a user.\nThis parameter cannot be used with either `ids` or `name` or when `owner` flag is set to `true`.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.invalidate_token.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.invalidate_token", "description": "Invalidate a token.\n\nThe access tokens returned by the get token API have a finite period of time for which they are valid.\nAfter that time period, they can no longer be used.\nThe time period is defined by the `xpack.security.authc.token.timeout` setting.\n\nThe refresh tokens returned by the get token API are only valid for 24 hours.\nThey can also be used exactly once.\nIf you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.\n\nNOTE: While all parameters are optional, at least one of them is required.\nMore specifically, either one of `token` or `refresh_token` parameters is required.\nIf none of these two are specified, then `realm_name` and/or `username` need to be specified.", "x-api": { "id": "security.invalidate_token", "name": "invalidate-token", "namespace": "security" }, "x-method": "DELETE", "x-path": "/_security/oauth2/token", "x-urls": [{ "path": "/_security/oauth2/token", "methods": ["DELETE"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "token": { "type": "string", "description": "An access token.\nThis parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "A refresh token.\nThis parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.", "x-found-in": "body" }, "realm_name": { "type": "string", "description": "The name of an authentication realm.\nThis parameter cannot be used with either `refresh_token` or `token`.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username of a user.\nThis parameter cannot be used with either `refresh_token` or `token`.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.invalidate_token", "description": "Invalidate a token.\n\nThe access tokens returned by the get token API have a finite period of time for which they are valid.\nAfter that time period, they can no longer be used.\nThe time period is defined by the `xpack.security.authc.token.timeout` setting.\n\nThe refresh tokens returned by the get token API are only valid for 24 hours.\nThey can also be used exactly once.\nIf you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API.\n\nNOTE: While all parameters are optional, at least one of them is required.\nMore specifically, either one of `token` or `refresh_token` parameters is required.\nIf none of these two are specified, then `realm_name` and/or `username` need to be specified.", "x-api": { "id": "security.invalidate_token", "name": "invalidate-token", "namespace": "security" }, "x-method": "DELETE", "x-path": "/_security/oauth2/token", "x-urls": [{ "path": "/_security/oauth2/token", "methods": ["DELETE"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "token": { "type": "string", "description": "An access token.\nThis parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "A refresh token.\nThis parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.", "x-found-in": "body" }, "realm_name": { "type": "string", "description": "The name of an authentication realm.\nThis parameter cannot be used with either `refresh_token` or `token`.", "x-found-in": "body" }, "username": { "type": "string", "description": "The username of a user.\nThis parameter cannot be used with either `refresh_token` or `token`.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.oidc_authenticate.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_authenticate", "description": "Authenticate OpenID Connect.\n\nExchange an OpenID Connect authentication response message for an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_authenticate", "name": "oidc-authenticate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/authenticate", "x-urls": [{ "path": "/_security/oidc/authenticate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "nonce": { "type": "string", "description": "Associate a client session with an ID token and mitigate replay attacks.\nThis value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the OpenID Connect realm.\nThis property is useful in cases where multiple realms are defined.", "x-found-in": "body" }, "redirect_uri": { "type": "string", "description": "The URL to which the OpenID Connect Provider redirected the User Agent in response to an authentication request after a successful authentication.\nThis URL must be provided as-is (URL encoded), taken from the body of the response or as the value of a location header in the response from the OpenID Connect Provider.", "x-found-in": "body" }, "state": { "type": "string", "description": "Maintain state between the authentication request and the response.\nThis value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.", "x-found-in": "body" } }, "required": ["nonce", "redirect_uri", "state"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_authenticate", "description": "Authenticate OpenID Connect.\n\nExchange an OpenID Connect authentication response message for an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_authenticate", "name": "oidc-authenticate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/authenticate", "x-urls": [{ "path": "/_security/oidc/authenticate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "nonce": { "type": "string", "description": "Associate a client session with an ID token and mitigate replay attacks.\nThis value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the OpenID Connect realm.\nThis property is useful in cases where multiple realms are defined.", "x-found-in": "body" }, "redirect_uri": { "type": "string", "description": "The URL to which the OpenID Connect Provider redirected the User Agent in response to an authentication request after a successful authentication.\nThis URL must be provided as-is (URL encoded), taken from the body of the response or as the value of a location header in the response from the OpenID Connect Provider.", "x-found-in": "body" }, "state": { "type": "string", "description": "Maintain state between the authentication request and the response.\nThis value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["nonce", "redirect_uri", "state"] }

package/lib/es/json/security.oidc_logout.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_logout", "description": "Logout of OpenID Connect.\n\nInvalidate an access token and a refresh token that were generated as a response to the `/_security/oidc/authenticate` API.\n\nIf the OpenID Connect authentication realm in Elasticsearch is accordingly configured, the response to this call will contain a URI pointing to the end session endpoint of the OpenID Connect Provider in order to perform single logout.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_logout", "name": "oidc-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/logout", "x-urls": [{ "path": "/_security/oidc/logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "token": { "type": "string", "description": "The access token to be invalidated.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The refresh token to be invalidated.", "x-found-in": "body" } }, "required": ["token"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_logout", "description": "Logout of OpenID Connect.\n\nInvalidate an access token and a refresh token that were generated as a response to the `/_security/oidc/authenticate` API.\n\nIf the OpenID Connect authentication realm in Elasticsearch is accordingly configured, the response to this call will contain a URI pointing to the end session endpoint of the OpenID Connect Provider in order to perform single logout.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_logout", "name": "oidc-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/logout", "x-urls": [{ "path": "/_security/oidc/logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "token": { "type": "string", "description": "The access token to be invalidated.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The refresh token to be invalidated.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["token"] }

package/lib/es/json/security.oidc_prepare_authentication.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_prepare_authentication", "description": "Prepare OpenID connect authentication.\n\nCreate an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch.\n\nThe response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_prepare_authentication", "name": "oidc-prepare-authentication", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/prepare", "x-urls": [{ "path": "/_security/oidc/prepare", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "iss": { "type": "string", "description": "In the case of a third party initiated single sign on, this is the issuer identifier for the OP that the RP is to send the authentication request to.\nIt cannot be specified when *realm* is specified.\nOne of *realm* or *iss* is required.", "x-found-in": "body" }, "login_hint": { "type": "string", "description": "In the case of a third party initiated single sign on, it is a string value that is included in the authentication request as the *login_hint* parameter.\nThis parameter is not valid when *realm* is specified.", "x-found-in": "body" }, "nonce": { "type": "string", "description": "The value used to associate a client session with an ID token and to mitigate replay attacks.\nIf the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the OpenID Connect realm in Elasticsearch the configuration of which should be used in order to generate the authentication request.\nIt cannot be specified when *iss* is specified.\nOne of *realm* or *iss* is required.", "x-found-in": "body" }, "state": { "type": "string", "description": "The value used to maintain state between the authentication request and the response, typically used as a Cross-Site Request Forgery mitigation.\nIf the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.oidc_prepare_authentication", "description": "Prepare OpenID connect authentication.\n\nCreate an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch.\n\nThe response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process.\n\nElasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs.\nThese APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.", "x-api": { "id": "security.oidc_prepare_authentication", "name": "oidc-prepare-authentication", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/oidc/prepare", "x-urls": [{ "path": "/_security/oidc/prepare", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "iss": { "type": "string", "description": "In the case of a third party initiated single sign on, this is the issuer identifier for the OP that the RP is to send the authentication request to.\nIt cannot be specified when *realm* is specified.\nOne of *realm* or *iss* is required.", "x-found-in": "body" }, "login_hint": { "type": "string", "description": "In the case of a third party initiated single sign on, it is a string value that is included in the authentication request as the *login_hint* parameter.\nThis parameter is not valid when *realm* is specified.", "x-found-in": "body" }, "nonce": { "type": "string", "description": "The value used to associate a client session with an ID token and to mitigate replay attacks.\nIf the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the OpenID Connect realm in Elasticsearch the configuration of which should be used in order to generate the authentication request.\nIt cannot be specified when *iss* is specified.\nOne of *realm* or *iss* is required.", "x-found-in": "body" }, "state": { "type": "string", "description": "The value used to maintain state between the authentication request and the response, typically used as a Cross-Site Request Forgery mitigation.\nIf the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.put_privileges.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_privileges", "description": "Create or update application privileges.\n\nTo use this API, you must have one of the following privileges:\n\n* The `manage_security` cluster privilege (or a greater privilege such as `all`).\n* The \"Manage Application Privileges\" global privilege for the application being referenced in the request.\n\nApplication names are formed from a prefix, with an optional suffix that conform to the following rules:\n\n* The prefix must begin with a lowercase ASCII letter.\n* The prefix must contain only ASCII letters or digits.\n* The prefix must be at least 3 characters long.\n* If the suffix exists, it must begin with either a dash `-` or `_`.\n* The suffix cannot contain any of the following characters: `\\`, `/`, `*`, `?`, `\"`, `<`, `>`, `|`, `,`, `*`.\n* No part of the name can contain whitespace.\n\nPrivilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters `_`, `-`, and `.`.\n\nAction names can contain any number of printable ASCII characters and must contain at least one of the following characters: `/`, `*`, `:`.", "x-api": { "id": "security.put_privileges", "name": "put-privileges", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/privilege", "x-urls": [{ "path": "/_security/privilege", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "6.4.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "privileges": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "$ref": "./security.put_privileges.json#/$defs/security.put_privileges__Actions" } }, "x-found-in": "body", "x-body-root": true } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_privileges", "description": "Create or update application privileges.\n\nTo use this API, you must have one of the following privileges:\n\n* The `manage_security` cluster privilege (or a greater privilege such as `all`).\n* The \"Manage Application Privileges\" global privilege for the application being referenced in the request.\n\nApplication names are formed from a prefix, with an optional suffix that conform to the following rules:\n\n* The prefix must begin with a lowercase ASCII letter.\n* The prefix must contain only ASCII letters or digits.\n* The prefix must be at least 3 characters long.\n* If the suffix exists, it must begin with either a dash `-` or `_`.\n* The suffix cannot contain any of the following characters: `\\`, `/`, `*`, `?`, `\"`, `<`, `>`, `|`, `,`, `*`.\n* No part of the name can contain whitespace.\n\nPrivilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters `_`, `-`, and `.`.\n\nAction names can contain any number of printable ASCII characters and must contain at least one of the following characters: `/`, `*`, `:`.", "x-api": { "id": "security.put_privileges", "name": "put-privileges", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/privilege", "x-urls": [{ "path": "/_security/privilege", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "6.4.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "privileges": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "$ref": "./security.put_privileges.json#/$defs/security.put_privileges__Actions" } }, "x-found-in": "body", "x-body-root": true }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.put_role.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_role", "description": "Create or update roles.\n\nThe role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management.\nThe create or update roles API cannot update roles that are defined in roles files.\nFile-based role management is not available in Elastic Serverless.", "x-api": { "id": "security.put_role", "name": "put-role", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/role/{name}", "x-urls": [{ "path": "/_security/role/{name}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "applications": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ApplicationPrivileges" }, "description": "A list of application privilege entries.", "x-found-in": "body" }, "cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ClusterPrivilege" }, "description": "A list of cluster privileges. These privileges define the cluster-level actions for users with this role.", "x-found-in": "body" }, "global": { "type": "object", "additionalProperties": {}, "description": "An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges.", "x-found-in": "body", "x-availability": { "stack": {} } }, "indices": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__IndicesPrivileges" }, "description": "A list of indices permissions entries.", "x-found-in": "body" }, "remote_indices": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RemoteIndicesPrivileges" }, "description": "A list of remote indices permissions entries.\n\nNOTE: Remote indices are effective for remote clusters configured with the API key based model.\nThey have no effect for remote clusters configured with the certificate based model.", "x-found-in": "body", "x-availability": { "stack": { "since": "8.14.0" } } }, "remote_cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RemoteClusterPrivileges" }, "description": "A list of remote cluster permissions entries.", "x-found-in": "body", "x-availability": { "stack": { "since": "8.15.0" } } }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Optional metadata. Within the metadata object, keys that begin with an underscore (`_`) are reserved for system use.", "x-found-in": "body" }, "run_as": { "type": "array", "items": { "type": "string" }, "description": "A list of users that the owners of this role can impersonate. *Note*: in Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty `run_as` field, but a non-empty list will be rejected.", "x-found-in": "body" }, "description": { "type": "string", "description": "Optional description of the role descriptor", "x-found-in": "body" }, "transient_metadata": { "type": "object", "additionalProperties": {}, "description": "Indicates roles that might be incompatible with the current cluster license, specifically roles with document and field level security. When the cluster license doesn’t allow certain features for a given role, this parameter is updated dynamically to list the incompatible features. If `enabled` is `false`, the role is ignored, but is still listed in the response from the authenticate API.", "x-found-in": "body" }, "name": { "type": "string", "description": "The name of the role that is being created or updated. On Elasticsearch Serverless, the role name must begin with a letter or digit and can only contain letters, digits and the characters '_', '-', and '.'. Each role must have a unique name, as this will serve as the identifier for that role.", "x-found-in": "path" } }, "required": ["name"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_role", "description": "Create or update roles.\n\nThe role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management.\nThe create or update roles API cannot update roles that are defined in roles files.\nFile-based role management is not available in Elastic Serverless.", "x-api": { "id": "security.put_role", "name": "put-role", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/role/{name}", "x-urls": [{ "path": "/_security/role/{name}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "applications": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ApplicationPrivileges" }, "description": "A list of application privilege entries.", "x-found-in": "body" }, "cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__ClusterPrivilege" }, "description": "A list of cluster privileges. These privileges define the cluster-level actions for users with this role.", "x-found-in": "body" }, "global": { "type": "object", "additionalProperties": {}, "description": "An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges.", "x-found-in": "body", "x-availability": { "stack": {} } }, "indices": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__IndicesPrivileges" }, "description": "A list of indices permissions entries.", "x-found-in": "body" }, "remote_indices": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RemoteIndicesPrivileges" }, "description": "A list of remote indices permissions entries.\n\nNOTE: Remote indices are effective for remote clusters configured with the API key based model.\nThey have no effect for remote clusters configured with the certificate based model.", "x-found-in": "body", "x-availability": { "stack": { "since": "8.14.0" } } }, "remote_cluster": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RemoteClusterPrivileges" }, "description": "A list of remote cluster permissions entries.", "x-found-in": "body", "x-availability": { "stack": { "since": "8.15.0" } } }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Optional metadata. Within the metadata object, keys that begin with an underscore (`_`) are reserved for system use.", "x-found-in": "body" }, "run_as": { "type": "array", "items": { "type": "string" }, "description": "A list of users that the owners of this role can impersonate. *Note*: in Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty `run_as` field, but a non-empty list will be rejected.", "x-found-in": "body" }, "description": { "type": "string", "description": "Optional description of the role descriptor", "x-found-in": "body" }, "transient_metadata": { "type": "object", "additionalProperties": {}, "description": "Indicates roles that might be incompatible with the current cluster license, specifically roles with document and field level security. When the cluster license doesn’t allow certain features for a given role, this parameter is updated dynamically to list the incompatible features. If `enabled` is `false`, the role is ignored, but is still listed in the response from the authenticate API.", "x-found-in": "body" }, "name": { "type": "string", "description": "The name of the role that is being created or updated. On Elasticsearch Serverless, the role name must begin with a letter or digit and can only contain letters, digits and the characters '_', '-', and '.'. Each role must have a unique name, as this will serve as the identifier for that role.", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["name"] }

package/lib/es/json/security.put_role_mapping.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_role_mapping", "description": "Create or update role mappings.\n\nRole mappings define which roles are assigned to each user.\nEach mapping has rules that identify users and a list of roles that are granted to those users.\nThe role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files.\n\nNOTE: This API does not create roles. Rather, it maps users to existing roles.\nRoles can be created by using the create or update roles API or roles files.\n\n**Role templates**\n\nThe most common use for role mappings is to create a mapping from a known value on the user to a fixed role name.\nFor example, all users in the `cn=admin,dc=example,dc=com` LDAP group should be given the superuser role in Elasticsearch.\nThe `roles` field is used for this purpose.\n\nFor more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user.\nThe `role_templates` field is used for this purpose.\n\nNOTE: To use role templates successfully, the relevant scripting feature must be enabled.\nOtherwise, all attempts to create a role mapping with role templates fail.\n\nAll of the user fields that are available in the role mapping rules are also available in the role templates.\nThus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated.\n\nBy default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user.\nIf the format of the template is set to \"json\" then the template is expected to produce a JSON string or an array of JSON strings for the role names.", "x-api": { "id": "security.put_role_mapping", "name": "put-role-mapping", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/role_mapping/{name}", "x-urls": [{ "path": "/_security/role_mapping/{name}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "enabled": { "type": "boolean", "description": "Mappings that have `enabled` set to `false` are ignored when role mapping is performed.", "x-found-in": "body" }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Additional metadata that helps define which roles are assigned to each user.\nWithin the metadata object, keys beginning with `_` are reserved for system usage.", "x-found-in": "body" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "A list of role names that are granted to the users that match the role mapping rules.\nExactly one of `roles` or `role_templates` must be specified.", "x-found-in": "body" }, "role_templates": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RoleTemplate" }, "description": "A list of Mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules.\nExactly one of `roles` or `role_templates` must be specified.", "x-found-in": "body" }, "rules": { "$ref": "./security._types.json#/$defs/security._types__RoleMappingRule", "description": "The rules that determine which users should be matched by the mapping.\nA rule is a logical condition that is expressed by using a JSON DSL.", "x-found-in": "body" }, "run_as": { "type": "array", "items": { "type": "string" }, "x-found-in": "body" }, "name": { "type": "string", "description": "The distinct name that identifies the role mapping.\nThe name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way.", "x-found-in": "path" } }, "required": ["name"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_role_mapping", "description": "Create or update role mappings.\n\nRole mappings define which roles are assigned to each user.\nEach mapping has rules that identify users and a list of roles that are granted to those users.\nThe role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files.\n\nNOTE: This API does not create roles. Rather, it maps users to existing roles.\nRoles can be created by using the create or update roles API or roles files.\n\n**Role templates**\n\nThe most common use for role mappings is to create a mapping from a known value on the user to a fixed role name.\nFor example, all users in the `cn=admin,dc=example,dc=com` LDAP group should be given the superuser role in Elasticsearch.\nThe `roles` field is used for this purpose.\n\nFor more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user.\nThe `role_templates` field is used for this purpose.\n\nNOTE: To use role templates successfully, the relevant scripting feature must be enabled.\nOtherwise, all attempts to create a role mapping with role templates fail.\n\nAll of the user fields that are available in the role mapping rules are also available in the role templates.\nThus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated.\n\nBy default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user.\nIf the format of the template is set to \"json\" then the template is expected to produce a JSON string or an array of JSON strings for the role names.", "x-api": { "id": "security.put_role_mapping", "name": "put-role-mapping", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/role_mapping/{name}", "x-urls": [{ "path": "/_security/role_mapping/{name}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "5.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.", "x-found-in": "query" }, "enabled": { "type": "boolean", "description": "Mappings that have `enabled` set to `false` are ignored when role mapping is performed.", "x-found-in": "body" }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Additional metadata that helps define which roles are assigned to each user.\nWithin the metadata object, keys beginning with `_` are reserved for system usage.", "x-found-in": "body" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "A list of role names that are granted to the users that match the role mapping rules.\nExactly one of `roles` or `role_templates` must be specified.", "x-found-in": "body" }, "role_templates": { "type": "array", "items": { "$ref": "./security._types.json#/$defs/security._types__RoleTemplate" }, "description": "A list of Mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules.\nExactly one of `roles` or `role_templates` must be specified.", "x-found-in": "body" }, "rules": { "$ref": "./security._types.json#/$defs/security._types__RoleMappingRule", "description": "The rules that determine which users should be matched by the mapping.\nA rule is a logical condition that is expressed by using a JSON DSL.", "x-found-in": "body" }, "run_as": { "type": "array", "items": { "type": "string" }, "x-found-in": "body" }, "name": { "type": "string", "description": "The distinct name that identifies the role mapping.\nThe name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way.", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["name"] }

package/lib/es/json/security.put_user.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_user", "description": "Create or update users.\n\nAdd and update users in the native realm.\nA password is required for adding a new user but is optional when updating an existing user.\nTo change a user's password without updating any other fields, use the change password API.", "x-api": { "id": "security.put_user", "name": "put-user", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/user/{username}", "x-urls": [{ "path": "/_security/user/{username}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "Valid values are `true`, `false`, and `wait_for`.\nThese values have the same meaning as in the index API, but the default value for this API is true.", "x-found-in": "query" }, "username": { "type": "string", "description": "An identifier for the user.\n\nNOTE: Usernames must be at least 1 and no more than 507 characters.\nThey can contain alphanumeric characters (a-z, A-Z, 0-9), spaces, punctuation, and printable symbols in the Basic Latin (ASCII) block.\nLeading or trailing whitespace is not allowed.", "x-found-in": "path" }, "email": { "anyOf": [{ "type": "string" }, { "type": "null" }], "description": "The email of the user.", "x-found-in": "body" }, "full_name": { "anyOf": [{ "type": "string" }, { "type": "null" }], "description": "The full name of the user.", "x-found-in": "body" }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Arbitrary metadata that you want to associate with the user.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nPasswords must be at least 6 characters long.\nWhen adding a user, one of `password` or `password_hash` is required.\nWhen updating an existing user, the password is optional, so that other fields on the user (such as their roles) may be updated without modifying the user's password", "x-found-in": "body" }, "password_hash": { "type": "string", "description": "A hash of the user's password.\nThis must be produced using the same hashing algorithm as has been configured for password storage.\nFor more details, see the explanation of the `xpack.security.authc.password_hashing.algorithm` setting in the user cache and password hash algorithm documentation.\nUsing this parameter allows the client to pre-hash the password for performance and/or confidentiality reasons.\nThe `password` parameter and the `password_hash` parameter cannot be used in the same request.", "x-found-in": "body" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "A set of roles the user has.\nThe roles determine the user's access permissions.\nTo create a user without any roles, specify an empty list (`[]`).", "x-found-in": "body" }, "enabled": { "type": "boolean", "description": "Specifies whether the user is enabled.", "x-found-in": "body" } }, "required": ["username"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.put_user", "description": "Create or update users.\n\nAdd and update users in the native realm.\nA password is required for adding a new user but is optional when updating an existing user.\nTo change a user's password without updating any other fields, use the change password API.", "x-api": { "id": "security.put_user", "name": "put-user", "namespace": "security" }, "x-method": "PUT", "x-path": "/_security/user/{username}", "x-urls": [{ "path": "/_security/user/{username}", "methods": ["PUT", "POST"] }], "x-destructive": true, "x-availability": { "stack": { "stability": "stable" } }, "type": "object", "properties": { "refresh": { "$ref": "./_types.json#/$defs/_types__Refresh", "description": "Valid values are `true`, `false`, and `wait_for`.\nThese values have the same meaning as in the index API, but the default value for this API is true.", "x-found-in": "query" }, "username": { "type": "string", "description": "An identifier for the user.\n\nNOTE: Usernames must be at least 1 and no more than 507 characters.\nThey can contain alphanumeric characters (a-z, A-Z, 0-9), spaces, punctuation, and printable symbols in the Basic Latin (ASCII) block.\nLeading or trailing whitespace is not allowed.", "x-found-in": "path" }, "email": { "anyOf": [{ "type": "string" }, { "type": "null" }], "description": "The email of the user.", "x-found-in": "body" }, "full_name": { "anyOf": [{ "type": "string" }, { "type": "null" }], "description": "The full name of the user.", "x-found-in": "body" }, "metadata": { "$ref": "./_types.json#/$defs/_types__Metadata", "description": "Arbitrary metadata that you want to associate with the user.", "x-found-in": "body" }, "password": { "type": "string", "description": "The user's password.\nPasswords must be at least 6 characters long.\nWhen adding a user, one of `password` or `password_hash` is required.\nWhen updating an existing user, the password is optional, so that other fields on the user (such as their roles) may be updated without modifying the user's password", "x-found-in": "body" }, "password_hash": { "type": "string", "description": "A hash of the user's password.\nThis must be produced using the same hashing algorithm as has been configured for password storage.\nFor more details, see the explanation of the `xpack.security.authc.password_hashing.algorithm` setting in the user cache and password hash algorithm documentation.\nUsing this parameter allows the client to pre-hash the password for performance and/or confidentiality reasons.\nThe `password` parameter and the `password_hash` parameter cannot be used in the same request.", "x-found-in": "body" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "A set of roles the user has.\nThe roles determine the user's access permissions.\nTo create a user without any roles, specify an empty list (`[]`).", "x-found-in": "body" }, "enabled": { "type": "boolean", "description": "Specifies whether the user is enabled.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["username"] }

package/lib/es/json/security.query_api_keys.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_api_keys", "description": "Find API keys with a query.\n\nGet a paginated list of API keys and their information.\nYou can optionally filter the results with a query.\n\nTo use this API, you must have at least the `manage_own_api_key` or the `read_security` cluster privileges.\nIf you have only the `manage_own_api_key` privilege, this API returns only the API keys that you own.\nIf you have the `read_security`, `manage_api_key`, or greater privileges (including `manage_security`), this API returns all API keys regardless of ownership.\nRefer to the linked documentation for examples of how to find API keys:", "x-api": { "id": "security.query_api_keys", "name": "query-api-keys", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/api_key", "x-urls": [{ "path": "/_security/_query/api_key", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "7.15.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "with_limited_by": { "type": "boolean", "description": "Return the snapshot of the owner user's role descriptors associated with the API key.\nAn API key's actual permission is the intersection of its assigned role descriptors and the owner user's role descriptors (effectively limited by it).\nAn API key cannot retrieve any API key’s limited-by role descriptors (including itself) unless it has `manage_api_key` or higher privileges.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.5.0" }, "serverless": {} } }, "with_profile_uid": { "type": "boolean", "description": "Determines whether to also retrieve the profile UID for the API key owner principal.\nIf it exists, the profile UID is returned under the `profile_uid` response field for each API key.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.14.0" }, "serverless": {} } }, "typed_keys": { "type": "boolean", "description": "Determines whether aggregation names are prefixed by their respective types in the response.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.14.0" }, "serverless": {} } }, "aggregations": { "type": "object", "additionalProperties": { "$ref": "./security.query_api_keys.json#/$defs/security.query_api_keys__ApiKeyAggregationContainer" }, "description": "Any aggregations to run over the corpus of returned API keys.\nAggregations and queries work together. Aggregations are computed only on the API keys that match the query.\nThis supports only a subset of aggregation types, namely: `terms`, `range`, `date_range`, `missing`,\n`cardinality`, `value_count`, `composite`, `filter`, and `filters`.\nAdditionally, aggregations only run over the same subset of fields that query works with.", "x-found-in": "body" }, "query": { "$ref": "./security.query_api_keys.json#/$defs/security.query_api_keys__ApiKeyQueryContainer", "description": "A query to filter which API keys to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following public information associated with an API key: `id`, `type`, `name`,\n`creation`, `expiration`, `invalidated`, `invalidation`, `username`, `realm`, and `metadata`.\n\nNOTE: The queryable string values associated with API keys are internally mapped as keywords.\nConsequently, if no `analyzer` parameter is specified for a `match` query, then the provided match query string is interpreted as a single keyword value.\nSuch a match query is hence equivalent to a `term` query.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nOther than `id`, all public fields of an API key are eligible for sorting.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nThe `size` parameter can be set to `0`, in which case no API key matches are returned, only the aggregation results.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_api_keys", "description": "Find API keys with a query.\n\nGet a paginated list of API keys and their information.\nYou can optionally filter the results with a query.\n\nTo use this API, you must have at least the `manage_own_api_key` or the `read_security` cluster privileges.\nIf you have only the `manage_own_api_key` privilege, this API returns only the API keys that you own.\nIf you have the `read_security`, `manage_api_key`, or greater privileges (including `manage_security`), this API returns all API keys regardless of ownership.\nRefer to the linked documentation for examples of how to find API keys:", "x-api": { "id": "security.query_api_keys", "name": "query-api-keys", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/api_key", "x-urls": [{ "path": "/_security/_query/api_key", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "7.15.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "with_limited_by": { "type": "boolean", "description": "Return the snapshot of the owner user's role descriptors associated with the API key.\nAn API key's actual permission is the intersection of its assigned role descriptors and the owner user's role descriptors (effectively limited by it).\nAn API key cannot retrieve any API key’s limited-by role descriptors (including itself) unless it has `manage_api_key` or higher privileges.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.5.0" }, "serverless": {} } }, "with_profile_uid": { "type": "boolean", "description": "Determines whether to also retrieve the profile UID for the API key owner principal.\nIf it exists, the profile UID is returned under the `profile_uid` response field for each API key.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.14.0" }, "serverless": {} } }, "typed_keys": { "type": "boolean", "description": "Determines whether aggregation names are prefixed by their respective types in the response.", "x-found-in": "query", "x-availability": { "stack": { "since": "8.14.0" }, "serverless": {} } }, "aggregations": { "type": "object", "additionalProperties": { "$ref": "./security.query_api_keys.json#/$defs/security.query_api_keys__ApiKeyAggregationContainer" }, "description": "Any aggregations to run over the corpus of returned API keys.\nAggregations and queries work together. Aggregations are computed only on the API keys that match the query.\nThis supports only a subset of aggregation types, namely: `terms`, `range`, `date_range`, `missing`,\n`cardinality`, `value_count`, `composite`, `filter`, and `filters`.\nAdditionally, aggregations only run over the same subset of fields that query works with.", "x-found-in": "body" }, "query": { "$ref": "./security.query_api_keys.json#/$defs/security.query_api_keys__ApiKeyQueryContainer", "description": "A query to filter which API keys to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following public information associated with an API key: `id`, `type`, `name`,\n`creation`, `expiration`, `invalidated`, `invalidation`, `username`, `realm`, and `metadata`.\n\nNOTE: The queryable string values associated with API keys are internally mapped as keywords.\nConsequently, if no `analyzer` parameter is specified for a `match` query, then the provided match query string is interpreted as a single keyword value.\nSuch a match query is hence equivalent to a `term` query.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nOther than `id`, all public fields of an API key are eligible for sorting.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nThe `size` parameter can be set to `0`, in which case no API key matches are returned, only the aggregation results.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.query_role.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_role", "description": "Find roles with a query.\n\nGet roles in a paginated manner.\nThe role management APIs are generally the preferred way to manage roles, rather than using file-based role management.\nThe query roles API does not retrieve roles that are defined in roles files, nor built-in ones.\nYou can optionally filter the results with a query.\nAlso, the results can be paginated and sorted.", "x-api": { "id": "security.query_role", "name": "query-role", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/role", "x-urls": [{ "path": "/_security/_query/role", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.15.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "query": { "$ref": "./security.query_role.json#/$defs/security.query_role__RoleQueryContainer", "description": "A query to filter which roles to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following information associated with roles: `name`, `description`, `metadata`,\n`applications.application`, `applications.privileges`, and `applications.resources`.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nYou can sort on `name`, `description`, `metadata`, `applications.application`, `applications.privileges`,\nand `applications.resources`.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_role", "description": "Find roles with a query.\n\nGet roles in a paginated manner.\nThe role management APIs are generally the preferred way to manage roles, rather than using file-based role management.\nThe query roles API does not retrieve roles that are defined in roles files, nor built-in ones.\nYou can optionally filter the results with a query.\nAlso, the results can be paginated and sorted.", "x-api": { "id": "security.query_role", "name": "query-role", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/role", "x-urls": [{ "path": "/_security/_query/role", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.15.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "public" } }, "type": "object", "properties": { "query": { "$ref": "./security.query_role.json#/$defs/security.query_role__RoleQueryContainer", "description": "A query to filter which roles to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following information associated with roles: `name`, `description`, `metadata`,\n`applications.application`, `applications.privileges`, and `applications.resources`.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nYou can sort on `name`, `description`, `metadata`, `applications.application`, `applications.privileges`,\nand `applications.resources`.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.query_user.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_user", "description": "Find users with a query.\n\nGet information for users in a paginated manner.\nYou can optionally filter the results with a query.\n\nNOTE: As opposed to the get user API, built-in users are excluded from the result.\nThis API is only for native users.", "x-api": { "id": "security.query_user", "name": "query-user", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/user", "x-urls": [{ "path": "/_security/_query/user", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.14.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "with_profile_uid": { "type": "boolean", "description": "Determines whether to retrieve the user profile UID, if it exists, for the users.", "x-found-in": "query" }, "query": { "$ref": "./security.query_user.json#/$defs/security.query_user__UserQueryContainer", "description": "A query to filter which users to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following information associated with user: `username`, `roles`, `enabled`, `full_name`, and `email`.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nFields eligible for sorting are: `username`, `roles`, `enabled`.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.query_user", "description": "Find users with a query.\n\nGet information for users in a paginated manner.\nYou can optionally filter the results with a query.\n\nNOTE: As opposed to the get user API, built-in users are excluded from the result.\nThis API is only for native users.", "x-api": { "id": "security.query_user", "name": "query-user", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/_query/user", "x-urls": [{ "path": "/_security/_query/user", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.14.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "with_profile_uid": { "type": "boolean", "description": "Determines whether to retrieve the user profile UID, if it exists, for the users.", "x-found-in": "query" }, "query": { "$ref": "./security.query_user.json#/$defs/security.query_user__UserQueryContainer", "description": "A query to filter which users to return.\nIf the query parameter is missing, it is equivalent to a `match_all` query.\nThe query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,\n`ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.\nYou can query the following information associated with user: `username`, `roles`, `enabled`, `full_name`, and `email`.", "x-found-in": "body" }, "from": { "type": "number", "description": "The starting document offset.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "sort": { "$ref": "./_types.json#/$defs/_types__Sort", "description": "The sort definition.\nFields eligible for sorting are: `username`, `roles`, `enabled`.\nIn addition, sort can also be applied to the `_doc` field to sort by index order.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of hits to return.\nIt must not be negative.\nBy default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.\nTo page through more hits, use the `search_after` parameter.", "x-found-in": "body" }, "search_after": { "$ref": "./_types.json#/$defs/_types__SortResults", "description": "The search after definition", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.saml_authenticate.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_authenticate", "description": "Authenticate SAML.\n\nSubmit a SAML response message to Elasticsearch for consumption.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe SAML message that is submitted can be:\n\n* A response to a SAML authentication request that was previously created using the SAML prepare authentication API.\n* An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow.\n\nIn either case, the SAML message needs to be a base64 encoded XML document with a root element of `<Response>`.\n\nAfter successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.\nThis API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.", "x-api": { "id": "security.saml_authenticate", "name": "saml-authenticate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/authenticate", "x-urls": [{ "path": "/_security/saml/authenticate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "content": { "type": "string", "description": "The SAML response as it was sent by the user's browser, usually a Base64 encoded XML document.", "x-found-in": "body" }, "ids": { "$ref": "./_types.json#/$defs/_types__Ids", "description": "A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the realm that should authenticate the SAML response. Useful in cases where many SAML realms are defined.", "x-found-in": "body" } }, "required": ["content", "ids"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_authenticate", "description": "Authenticate SAML.\n\nSubmit a SAML response message to Elasticsearch for consumption.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe SAML message that is submitted can be:\n\n* A response to a SAML authentication request that was previously created using the SAML prepare authentication API.\n* An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow.\n\nIn either case, the SAML message needs to be a base64 encoded XML document with a root element of `<Response>`.\n\nAfter successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication.\nThis API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.", "x-api": { "id": "security.saml_authenticate", "name": "saml-authenticate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/authenticate", "x-urls": [{ "path": "/_security/saml/authenticate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "content": { "type": "string", "description": "The SAML response as it was sent by the user's browser, usually a Base64 encoded XML document.", "x-found-in": "body" }, "ids": { "$ref": "./_types.json#/$defs/_types__Ids", "description": "A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the realm that should authenticate the SAML response. Useful in cases where many SAML realms are defined.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["content", "ids"] }

package/lib/es/json/security.saml_complete_logout.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_complete_logout", "description": "Logout of SAML completely.\n\nVerifies the logout response sent from the SAML IdP.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout.\nThis API verifies the response by ensuring the content is relevant and validating its signature.\nAn empty response is returned if the verification process is successful.\nThe response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding.\nThe caller of this API must prepare the request accordingly so that this API can handle either of them.", "x-api": { "id": "security.saml_complete_logout", "name": "saml-complete-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/complete_logout", "x-urls": [{ "path": "/_security/saml/complete_logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.14.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch for which the configuration is used to verify the logout response.", "x-found-in": "body" }, "ids": { "$ref": "./_types.json#/$defs/_types__Ids", "description": "A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.", "x-found-in": "body" }, "query_string": { "type": "string", "description": "If the SAML IdP sends the logout response with the HTTP-Redirect binding, this field must be set to the query string of the redirect URI.", "x-found-in": "body" }, "content": { "type": "string", "description": "If the SAML IdP sends the logout response with the HTTP-Post binding, this field must be set to the value of the SAMLResponse form parameter from the logout response.", "x-found-in": "body" } }, "required": ["realm", "ids"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_complete_logout", "description": "Logout of SAML completely.\n\nVerifies the logout response sent from the SAML IdP.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout.\nThis API verifies the response by ensuring the content is relevant and validating its signature.\nAn empty response is returned if the verification process is successful.\nThe response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding.\nThe caller of this API must prepare the request accordingly so that this API can handle either of them.", "x-api": { "id": "security.saml_complete_logout", "name": "saml-complete-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/complete_logout", "x-urls": [{ "path": "/_security/saml/complete_logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.14.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch for which the configuration is used to verify the logout response.", "x-found-in": "body" }, "ids": { "$ref": "./_types.json#/$defs/_types__Ids", "description": "A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.", "x-found-in": "body" }, "query_string": { "type": "string", "description": "If the SAML IdP sends the logout response with the HTTP-Redirect binding, this field must be set to the query string of the redirect URI.", "x-found-in": "body" }, "content": { "type": "string", "description": "If the SAML IdP sends the logout response with the HTTP-Post binding, this field must be set to the value of the SAMLResponse form parameter from the logout response.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["realm", "ids"] }

package/lib/es/json/security.saml_invalidate.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_invalidate", "description": "Invalidate SAML.\n\nSubmit a SAML LogoutRequest message to Elasticsearch for consumption.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe logout request comes from the SAML IdP during an IdP initiated Single Logout.\nThe custom web application can use this API to have Elasticsearch process the `LogoutRequest`.\nAfter successful validation of the request, Elasticsearch invalidates the access token and refresh token that corresponds to that specific SAML principal and provides a URL that contains a SAML LogoutResponse message.\nThus the user can be redirected back to their IdP.", "x-api": { "id": "security.saml_invalidate", "name": "saml-invalidate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/invalidate", "x-urls": [{ "path": "/_security/saml/invalidate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "acs": { "type": "string", "description": "The Assertion Consumer Service URL that matches the one of the SAML realm in Elasticsearch that should be used. You must specify either this parameter or the `realm` parameter.", "x-found-in": "body" }, "query_string": { "type": "string", "description": "The query part of the URL that the user was redirected to by the SAML IdP to initiate the Single Logout.\nThis query should include a single parameter named `SAMLRequest` that contains a SAML logout request that is deflated and Base64 encoded.\nIf the SAML IdP has signed the logout request, the URL should include two extra parameters named `SigAlg` and `Signature` that contain the algorithm used for the signature and the signature value itself.\nIn order for Elasticsearch to be able to verify the IdP's signature, the value of the `query_string` field must be an exact match to the string provided by the browser.\nThe client application must not attempt to parse or process the string in any way.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch the configuration. You must specify either this parameter or the `acs` parameter.", "x-found-in": "body" } }, "required": ["query_string"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_invalidate", "description": "Invalidate SAML.\n\nSubmit a SAML LogoutRequest message to Elasticsearch for consumption.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThe logout request comes from the SAML IdP during an IdP initiated Single Logout.\nThe custom web application can use this API to have Elasticsearch process the `LogoutRequest`.\nAfter successful validation of the request, Elasticsearch invalidates the access token and refresh token that corresponds to that specific SAML principal and provides a URL that contains a SAML LogoutResponse message.\nThus the user can be redirected back to their IdP.", "x-api": { "id": "security.saml_invalidate", "name": "saml-invalidate", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/invalidate", "x-urls": [{ "path": "/_security/saml/invalidate", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "acs": { "type": "string", "description": "The Assertion Consumer Service URL that matches the one of the SAML realm in Elasticsearch that should be used. You must specify either this parameter or the `realm` parameter.", "x-found-in": "body" }, "query_string": { "type": "string", "description": "The query part of the URL that the user was redirected to by the SAML IdP to initiate the Single Logout.\nThis query should include a single parameter named `SAMLRequest` that contains a SAML logout request that is deflated and Base64 encoded.\nIf the SAML IdP has signed the logout request, the URL should include two extra parameters named `SigAlg` and `Signature` that contain the algorithm used for the signature and the signature value itself.\nIn order for Elasticsearch to be able to verify the IdP's signature, the value of the `query_string` field must be an exact match to the string provided by the browser.\nThe client application must not attempt to parse or process the string in any way.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch the configuration. You must specify either this parameter or the `acs` parameter.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["query_string"] }

package/lib/es/json/security.saml_logout.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_logout", "description": "Logout of SAML.\n\nSubmits a request to invalidate an access token and refresh token.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThis API invalidates the tokens that were generated for a user by the SAML authenticate API.\nIf the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).", "x-api": { "id": "security.saml_logout", "name": "saml-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/logout", "x-urls": [{ "path": "/_security/saml/logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "token": { "type": "string", "description": "The access token that was returned as a response to calling the SAML authenticate API.\nAlternatively, the most recent token that was received after refreshing the original one by using a `refresh_token`.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The refresh token that was returned as a response to calling the SAML authenticate API.\nAlternatively, the most recent refresh token that was received after refreshing the original access token.", "x-found-in": "body" } }, "required": ["token"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_logout", "description": "Logout of SAML.\n\nSubmits a request to invalidate an access token and refresh token.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThis API invalidates the tokens that were generated for a user by the SAML authenticate API.\nIf the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).", "x-api": { "id": "security.saml_logout", "name": "saml-logout", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/logout", "x-urls": [{ "path": "/_security/saml/logout", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "token": { "type": "string", "description": "The access token that was returned as a response to calling the SAML authenticate API.\nAlternatively, the most recent token that was received after refreshing the original one by using a `refresh_token`.", "x-found-in": "body" }, "refresh_token": { "type": "string", "description": "The refresh token that was returned as a response to calling the SAML authenticate API.\nAlternatively, the most recent refresh token that was received after refreshing the original access token.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["token"] }

package/lib/es/json/security.saml_prepare_authentication.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_prepare_authentication", "description": "Prepare SAML authentication.\n\nCreate a SAML authentication request (`<AuthnRequest>`) as a URL string based on the configuration of the respective SAML realm in Elasticsearch.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThis API returns a URL pointing to the SAML Identity Provider.\nYou can use the URL to redirect the browser of the user in order to continue the authentication process.\nThe URL includes a single parameter named `SAMLRequest`, which contains a SAML Authentication request that is deflated and Base64 encoded.\nIf the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named `SigAlg` and `Signature`.\nThese parameters contain the algorithm used for the signature and the signature value itself.\nIt also returns a random string that uniquely identifies this SAML Authentication request.\nThe caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.", "x-api": { "id": "security.saml_prepare_authentication", "name": "saml-prepare-authentication", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/prepare", "x-urls": [{ "path": "/_security/saml/prepare", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "acs": { "type": "string", "description": "The Assertion Consumer Service URL that matches the one of the SAML realms in Elasticsearch.\nThe realm is used to generate the authentication request. You must specify either this parameter or the `realm` parameter.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch for which the configuration is used to generate the authentication request.\nYou must specify either this parameter or the `acs` parameter.", "x-found-in": "body" }, "relay_state": { "type": "string", "description": "A string that will be included in the redirect URL that this API returns as the `RelayState` query parameter.\nIf the Authentication Request is signed, this value is used as part of the signature computation.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_prepare_authentication", "description": "Prepare SAML authentication.\n\nCreate a SAML authentication request (`<AuthnRequest>`) as a URL string based on the configuration of the respective SAML realm in Elasticsearch.\n\nNOTE: This API is intended for use by custom web applications other than Kibana.\nIf you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.\n\nThis API returns a URL pointing to the SAML Identity Provider.\nYou can use the URL to redirect the browser of the user in order to continue the authentication process.\nThe URL includes a single parameter named `SAMLRequest`, which contains a SAML Authentication request that is deflated and Base64 encoded.\nIf the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named `SigAlg` and `Signature`.\nThese parameters contain the algorithm used for the signature and the signature value itself.\nIt also returns a random string that uniquely identifies this SAML Authentication request.\nThe caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.", "x-api": { "id": "security.saml_prepare_authentication", "name": "saml-prepare-authentication", "namespace": "security" }, "x-method": "POST", "x-path": "/_security/saml/prepare", "x-urls": [{ "path": "/_security/saml/prepare", "methods": ["POST"] }], "x-destructive": true, "x-availability": { "stack": { "since": "7.5.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "acs": { "type": "string", "description": "The Assertion Consumer Service URL that matches the one of the SAML realms in Elasticsearch.\nThe realm is used to generate the authentication request. You must specify either this parameter or the `realm` parameter.", "x-found-in": "body" }, "realm": { "type": "string", "description": "The name of the SAML realm in Elasticsearch for which the configuration is used to generate the authentication request.\nYou must specify either this parameter or the `acs` parameter.", "x-found-in": "body" }, "relay_state": { "type": "string", "description": "A string that will be included in the redirect URL that this API returns as the `RelayState` query parameter.\nIf the Authentication Request is signed, this value is used as part of the signature computation.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }

package/lib/es/json/security.saml_service_provider_metadata.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_service_provider_metadata", "description": "Create SAML service provider metadata.\n\nGenerate SAML metadata for a SAML 2.0 Service Provider.\n\nThe SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file.\nThis API generates Service Provider metadata based on the configuration of a SAML realm in Elasticsearch.", "x-api": { "id": "security.saml_service_provider_metadata", "name": "saml-service-provider-metadata", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/saml/metadata/{realm_name}", "x-urls": [{ "path": "/_security/saml/metadata/{realm_name}", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "7.11.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "realm_name": { "type": "string", "description": "The name of the SAML realm in Elasticsearch.", "x-found-in": "path" } }, "required": ["realm_name"] }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.saml_service_provider_metadata", "description": "Create SAML service provider metadata.\n\nGenerate SAML metadata for a SAML 2.0 Service Provider.\n\nThe SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file.\nThis API generates Service Provider metadata based on the configuration of a SAML realm in Elasticsearch.", "x-api": { "id": "security.saml_service_provider_metadata", "name": "saml-service-provider-metadata", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/saml/metadata/{realm_name}", "x-urls": [{ "path": "/_security/saml/metadata/{realm_name}", "methods": ["GET"] }], "x-destructive": false, "x-availability": { "stack": { "since": "7.11.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "realm_name": { "type": "string", "description": "The name of the SAML realm in Elasticsearch.", "x-found-in": "path" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } }, "required": ["realm_name"] }

package/lib/es/json/security.suggest_user_profiles.request.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.suggest_user_profiles", "description": "Suggest a user profile.\n\nGet suggestions for user profiles that match specified search criteria.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions.\nIndividual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.suggest_user_profiles", "name": "suggest-user-profiles", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/_suggest", "x-urls": [{ "path": "/_security/profile/_suggest", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.2.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "data": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A comma-separated list of filters for the `data` field of the profile document.\nTo return all content use `data=*`.\nTo return a subset of content, use `data=<key>` to retrieve content nested under the specified `<key>`.\nBy default, the API returns no `data` content.\nIt is an error to specify `data` as both the query parameter and the request body field.", "x-found-in": "body" }, "name": { "type": "string", "description": "A query string used to match name-related fields in user profile documents.\nName-related fields are the user's `username`, `full_name`, and `email`.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of profiles to return.", "x-found-in": "body" }, "hint": { "$ref": "./security.suggest_user_profiles.json#/$defs/security.suggest_user_profiles__Hint", "description": "Extra search criteria to improve relevance of the suggestion result.\nProfiles matching the spcified hint are ranked higher in the response.\nProfiles not matching the hint aren't excluded from the response as long as the profile matches the `name` field query.", "x-found-in": "body" } } }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "security.suggest_user_profiles", "description": "Suggest a user profile.\n\nGet suggestions for user profiles that match specified search criteria.\n\nNOTE: The user profile feature is designed only for use by Kibana and Elastic's Observability, Enterprise Search, and Elastic Security solutions.\nIndividual users and external applications should not call this API directly.\nElastic reserves the right to change or remove this feature in future releases without prior notice.", "x-api": { "id": "security.suggest_user_profiles", "name": "suggest-user-profiles", "namespace": "security" }, "x-method": "GET", "x-path": "/_security/profile/_suggest", "x-urls": [{ "path": "/_security/profile/_suggest", "methods": ["GET", "POST"] }], "x-destructive": false, "x-availability": { "stack": { "since": "8.2.0", "stability": "stable" }, "serverless": { "stability": "stable", "visibility": "private" } }, "type": "object", "properties": { "data": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "A comma-separated list of filters for the `data` field of the profile document.\nTo return all content use `data=*`.\nTo return a subset of content, use `data=<key>` to retrieve content nested under the specified `<key>`.\nBy default, the API returns no `data` content.\nIt is an error to specify `data` as both the query parameter and the request body field.", "x-found-in": "body" }, "name": { "type": "string", "description": "A query string used to match name-related fields in user profile documents.\nName-related fields are the user's `username`, `full_name`, and `email`.", "x-found-in": "body" }, "size": { "type": "number", "description": "The number of profiles to return.", "x-found-in": "body" }, "hint": { "$ref": "./security.suggest_user_profiles.json#/$defs/security.suggest_user_profiles__Hint", "description": "Extra search criteria to improve relevance of the suggestion result.\nProfiles matching the spcified hint are ranked higher in the response.\nProfiles not matching the hint aren't excluded from the response as long as the profile matches the `name` field query.", "x-found-in": "body" }, "error_trace": { "type": "boolean", "description": "When set to `true` Elasticsearch will include the full stack trace of errors\nwhen they occur.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "filter_path": { "anyOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }], "description": "Comma-separated list of filters in dot notation which reduce the response\nreturned by Elasticsearch.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "human": { "type": "boolean", "description": "When set to `true` will return statistics in a format suitable for humans.\nFor example `\"exists_time\": \"1h\"` for humans and\n`\"exists_time_in_millis\": 3600000` for computers. When disabled the human\nreadable values will be omitted. This makes sense for responses being consumed\nonly by machines.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" }, "pretty": { "type": "boolean", "description": "If set to `true` the returned JSON will be \"pretty-formatted\". Only use\nthis option for debugging only.", "x-found-in": "query", "x-behavior": "CommonQueryParameters" } } }