openapi: 3.2.0 info: title: Elk Stack Security API version: '' x-refined-note: - x-doc-license differs across the merged source definitions and was not carried - x-feedbackLink differs across the merged source definitions and was not carried description: 'Operations tagged security across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.' servers: - url: https://{kibana_url} variables: kibana_url: default: localhost:5601 tags: - name: security paths: /_encryption/_reset: post: tags: - security summary: Reset the project encryption key description: 'Destroy the current project encryption key (PEK) and generate a new one. This is the recovery path for when the on-disk encrypted PEK becomes permanently inaccessible, for example because the key encryption material protecting it was lost. All data that was encrypted under the destroyed key becomes permanently unrecoverable. Each feature that stores encrypted data decides how to handle its own data during the reset: some features drop the encrypted values entirely, while others preserve the rest of the affected data and only clear the values that can no longer be decrypted. Because this operation causes permanent data loss, it requires the `accept_data_loss` query parameter to be set to `true`.' operationId: encryption-reset parameters: - in: query name: accept_data_loss description: 'Acknowledge that resetting the project encryption key permanently destroys all data that was encrypted under the current key. The request fails if this is not set to `true`.' required: true deprecated: false schema: type: boolean style: form - in: query name: master_timeout description: 'The period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.' deprecated: false schema: default: 30s allOf: - $ref: '#/components/schemas/_types.Duration' style: form - in: query name: timeout description: 'The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.' deprecated: false schema: default: 30s allOf: - $ref: '#/components/schemas/_types.Duration' style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: EncryptionResetResponseExample1: summary: Reset the project encryption key description: 'A successful response from `POST /_encryption/_reset?accept_data_loss=true`. ' value: "{\n \"acknowledged\": true\n}" x-state: Experimental; Added in 9.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/profile/_activate: post: tags: - security summary: Activate a user profile description: 'Create or update a user profile on behalf of another user. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. The calling application must have either an `access_token` or a combination of `username` and `password` for the user that the profile document is intended for. Elastic reserves the right to change or remove this feature in future releases without prior notice. This API creates or updates a profile document for end users with information that is extracted from the user''s authentication object including `username`, `full_name,` `roles`, and the authentication realm. For example, in the JWT `access_token` case, the profile user''s `username` is extracted from the JWT token claim pointed to by the `claims.principal` setting of the JWT realm that authenticated the token. When updating a profile document, the API enables the document if it was disabled. Any updates do not change existing content for either the `labels` or `data` fields. ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-activate-user-profile requestBody: content: application/json: schema: type: object properties: access_token: description: 'The user''s Elasticsearch access token or JWT. Both `access` and `id` JWT token types are supported and they depend on the underlying JWT realm configuration. If you specify the `access_token` grant type, this parameter is required. It is not valid with other grant types.' type: string grant_type: description: The type of grant. allOf: - $ref: '#/components/schemas/security._types.GrantType' password: description: 'The user''s password. If you specify the `password` grant type, this parameter is required. It is not valid with other grant types.' type: string username: description: 'The username that identifies the user. If you specify the `password` grant type, this parameter is required. It is not valid with other grant types.' type: string required: - grant_type examples: ActivateUserProfileRequestExample1: description: 'Run `POST /_security/profile/_activate` to activate a user profile. ' value: "{\n \"grant_type\": \"password\",\n \"username\" : \"jacknich\",\n \"password\" : \"l0ng-r4nd0m-p@ssw0rd\"\n}" required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/security._types.UserProfileWithMetadata' examples: ActivateUserProfileResponseExample1: description: A successful response from `POST /_security/profile/_activate`. value: "{\n \"uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\",\n \"enabled\": true,\n \"last_synchronized\": 1642650651037,\n \"user\": {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\", \"other_role1\"\n ],\n \"realm_name\": \"native\",\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\"\n },\n \"labels\": {},\n \"data\": {},\n \"_doc\": {\n \"_primary_term\": 88,\n \"_seq_no\": 66\n }\n}" x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/_authenticate: get: tags: - security summary: Authenticate a user description: 'Authenticates a user and returns information about the authenticated user. Include the user information in a [basic auth header](https://en.wikipedia.org/wiki/Basic_access_authentication). A successful call returns a JSON structure that shows user information such as their username, the roles that are assigned to the user, any assigned metadata, and information about the realms that authenticated and authorized the user. If the user cannot be authenticated, this API returns a 401 status code.' operationId: security-authenticate responses: '200': description: '' content: application/json: schema: type: object properties: api_key: allOf: - $ref: '#/components/schemas/security.authenticate.AuthenticateApiKey' authentication_realm: allOf: - $ref: '#/components/schemas/security._types.RealmInfo' email: oneOf: - type: string - type: - string - 'null' full_name: oneOf: - $ref: '#/components/schemas/_types.Name' - type: - string - 'null' lookup_realm: allOf: - $ref: '#/components/schemas/security._types.RealmInfo' metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' roles: type: array items: type: string username: allOf: - $ref: '#/components/schemas/_types.Username' enabled: type: boolean authentication_type: type: string token: x-state: Generally available; Added in 7.14.0 allOf: - $ref: '#/components/schemas/security.authenticate.Token' required: - authentication_realm - lookup_realm - metadata - roles - username - enabled - authentication_type examples: SecurityAuthenticateResponseExample1: description: A successful response from `GET /_security/_authenticate`. value: "{\n \"username\": \"rdeniro\",\n \"roles\": [\n \"admin\"\n ],\n \"full_name\": null,\n \"email\": null,\n \"metadata\": { },\n \"enabled\": true,\n \"authentication_realm\": {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"lookup_realm\": {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"authentication_type\": \"realm\"\n}" SecurityAuthenticateResponseExample2: description: A successful response from `GET /_security/_authenticate` for access token authentication. value: "{\n \"username\": \"0000000001\",\n \"roles\": [\n \"admin\"\n ],\n \"full_name\": \"Peter Parker\",\n \"email\": \"spider-man@marvel.com\",\n \"metadata\": {},\n \"enabled\": true,\n \"authentication_realm\": {\n \"name\": \"cloud-saml-kibana\",\n \"type\": \"saml\"\n },\n \"lookup_realm\": {\n \"name\": \"cloud-saml-kibana\",\n \"type\": \"saml\"\n },\n \"authentication_type\": \"token\",\n \"token\": {\n \"managed_by\": \"cloud\"\n }\n}" SecurityAuthenticateResponseExample3: description: A successful response from `GET /_security/_authenticate` for service account token authentication. value: "{\n \"username\": \"elastic/fleet-server\",\n \"roles\": [ ],\n \"full_name\": \"Service account - elastic/fleet-server\",\n \"email\": null,\n \"metadata\": {\n \"_elastic_service_account\": true\n },\n \"enabled\": true,\n \"authentication_realm\": {\n \"name\": \"_service_account\",\n \"type\": \"_service_account\"\n },\n \"lookup_realm\": {\n \"name\": \"_service_account\",\n \"type\": \"_service_account\"\n },\n \"authentication_type\": \"token\",\n \"token\": {\n \"type\": \"_service_account_index\",\n \"name\": \"token_abcd1234\",\n \"managed_by\": \"elasticsearch\"\n }\n}" x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/role: get: tags: - security summary: Get roles description: 'Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-role-1 parameters: - $ref: '#/components/parameters/security.get_role-include_implicit' responses: '200': $ref: '#/components/responses/security.get_role-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Bulk create or update roles description: 'The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk create or update roles API cannot update roles that are defined in roles files. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-bulk-put-role parameters: - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form requestBody: content: application/json: schema: type: object properties: roles: description: A dictionary of role name to RoleDescriptor objects to add or update type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' required: - roles examples: SecurityBulkPutRoleRequestExample1: summary: Bulk role success description: 'Run `POST /_security/role` to add roles called `my_admin_role` and `my_user_role`. ' value: "{\n \"roles\": {\n \"my_admin_role\": {\n \"cluster\": [\n \"all\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index1\",\n \"index2\"\n ],\n \"privileges\": [\n \"all\"\n ],\n \"field_security\": {\n \"grant\": [\n \"title\",\n \"body\"\n ]\n },\n \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n }\n ],\n \"applications\": [\n {\n \"application\": \"myapp\",\n \"privileges\": [\n \"admin\",\n \"read\"\n ],\n \"resources\": [\n \"*\"\n ]\n }\n ],\n \"run_as\": [\n \"other_user\"\n ],\n \"metadata\": {\n \"version\": 1\n }\n },\n \"my_user_role\": {\n \"cluster\": [\n \"all\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index1\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"field_security\": {\n \"grant\": [\n \"title\",\n \"body\"\n ]\n },\n \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n }\n ],\n \"applications\": [\n {\n \"application\": \"myapp\",\n \"privileges\": [\n \"admin\",\n \"read\"\n ],\n \"resources\": [\n \"*\"\n ]\n }\n ],\n \"run_as\": [\n \"other_user\"\n ],\n \"metadata\": {\n \"version\": 1\n }\n }\n }\n}" SecurityBulkPutRoleRequestExample2: summary: Bulk role errors description: 'Because errors are handled individually for each role create or update, the API allows partial success. For example, `POST /_security/role` would throw an error for `my_admin_role` because the privilege `bad_cluster_privilege` doesn''t exist, but would be successful for the `my_user_role`. ' value: "{\n \"roles\": {\n \"my_admin_role\": {\n \"cluster\": [\n \"bad_cluster_privilege\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index1\",\n \"index2\"\n ],\n \"privileges\": [\"all\"],\n \"field_security\": {\n \"grant\": [\n \"title\",\n \"body\"\n ]\n },\n \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n }\n ],\n \"applications\": [\n {\n \"application\": \"myapp\",\n \"privileges\": [\n \"admin\",\n \"read\"\n ],\n \"resources\": [\n \"*\"\n ]\n }\n ],\n \"run_as\": [\n \"other_user\"\n ],\n \"metadata\": {\n \"version\": 1\n }\n },\n \"my_user_role\": {\n \"cluster\": [\n \"all\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index1\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"field_security\": {\n \"grant\": [\n \"title\",\n \"body\"\n ]\n },\n \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\"\n }\n ],\n \"applications\": [\n {\n \"application\": \"myapp\",\n \"privileges\": [\n \"admin\",\n \"read\"\n ],\n \"resources\": [\n \"*\"\n ]\n }\n ],\n \"run_as\": [\n \"other_user\"\n ],\n \"metadata\": {\n \"version\": 1\n }\n }\n }\n}" SecurityBulkPutRoleRequestExample3: summary: Role example 3 description: Run `POST /_security/role/only_remote_access_role` to configure a role with remote indices and remote cluster privileges for a remote cluster. value: "{\n \"remote_indices\": [\n {\n \"clusters\": [\"my_remote\"], \n \"names\": [\"logs*\"], \n \"privileges\": [\"read\", \"read_cross_cluster\", \"view_index_metadata\"] \n }\n ],\n \"remote_cluster\": [\n {\n \"clusters\": [\"my_remote\"], \n \"privileges\": [\"monitor_stats\"] \n }\n ]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: created: description: Array of created roles type: array items: type: string updated: description: Array of updated roles type: array items: type: string noop: description: Array of role names without any changes type: array items: type: string errors: description: Present if any updates resulted in errors allOf: - $ref: '#/components/schemas/security._types.BulkError' examples: SecurityBulkPutRoleResponseExample1: summary: A successful response description: 'A successful response from `POST /_security/role/my_admin_role` returns a JSON structure that shows whether the role has been created, updated, or had no changes made. ' value: "{\n \"created\": [ \n \"my_admin_role\", \n \"my_user_role\"\n ]\n}" SecurityBulkPutRoleResponseExample2: summary: A partially successful response description: 'A partially successful response from `POST /_security/role`. Errors are handled individually for each role create or update, thus the API allows partial success. In this example, the creation of the `my_user_role` role succeeds and the `my_admin_role` role fails. ' value: "{\n \"created\": [\n \"my_user_role\" \n ],\n \"errors\": { \n \"count\": 1, \n \"details\": {\n \"my_admin_role\": { \n \"type\": \"action_request_validation_exception\",\n \"reason\": \"Validation Failed: 1: unknown cluster privilege [bad_cluster_privilege]. a privilege must be either one of the predefined cluster privilege names [manage_own_api_key,manage_data_stream_global_retention,monitor_data_stream_global_retention,none,cancel_task,cross_cluster_replication,cross_cluster_search,delegate_pki,grant_api_key,manage_autoscaling,manage_index_templates,manage_logstash_pipelines,manage_oidc,manage_saml,manage_search_application,manage_search_query_rules,manage_search_synonyms,manage_service_account,manage_token,manage_user_profile,monitor_connector,monitor_enrich,monitor_inference,monitor_ml,monitor_rollup,monitor_snapshot,monitor_stats,monitor_text_structure,monitor_watcher,post_behavioral_analytics_event,read_ccr,read_connector_secrets,read_fleet_secrets,read_ilm,read_pipeline,read_security,read_slm,transport_client,write_connector_secrets,write_fleet_secrets,create_snapshot,manage_behavioral_analytics,manage_ccr,manage_connector,manage_enrich,manage_ilm,manage_inference,manage_ml,manage_rollup,manage_slm,manage_watcher,monitor_data_frame_transforms,monitor_transform,manage_api_key,manage_ingest_pipelines,manage_pipeline,manage_data_frame_transforms,manage_transform,manage_security,monitor,manage,all] or a pattern over one of the available cluster actions;\"\n }\n }\n }\n}" x-state: Generally available; Added in 8.15.0 x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Bulk delete roles description: 'The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The bulk delete roles API cannot delete roles that are defined in roles files. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-bulk-delete-role parameters: - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form requestBody: content: application/json: schema: type: object properties: names: description: An array of role names to delete type: array items: type: string required: - names examples: SecurityBulkDeleteRoleRequestExample1: summary: Bulk delete example 1 description: 'Run DELETE /_security/role` to delete `my_admin_role` and `my_user_role` roles. ' value: "{\n \"names\": [\"my_admin_role\", \"my_user_role\"]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: deleted: description: Array of deleted roles type: array items: type: string not_found: description: Array of roles that could not be found type: array items: type: string errors: description: Present if any deletes resulted in errors allOf: - $ref: '#/components/schemas/security._types.BulkError' examples: SecurityBulkDeleteRoleResponseExample1: summary: A successful response description: A successful response from `DELETE /_security/role`. value: "{\n \"deleted\": [\n \"my_admin_role\",\n \"my_user_role\"\n ]\n}" SecurityBulkDeleteRoleResponseExample2: summary: A response with not_found roles description: 'A partially successful response from `DELETE /_security/role`. If a role cannot be found, it appears in the `not_found` list in the response. ' value: "{\n \"deleted\": [\n \"my_admin_role\"\n ],\n \"not_found\": [\n \"not_an_existing_role\"\n ]\n}" SecurityBulkDeleteRoleResponseExample3: summary: A response with errors description: 'A partially successful response from `DELETE /_security/role`. If part of a request fails or is invalid, the response includes `errors`. ' value: "{\n \"deleted\": [\n \"my_admin_role\"\n ],\n \"errors\": {\n \"count\": 1,\n \"details\": {\n \"superuser\": {\n \"type\": \"illegal_argument_exception\",\n \"reason\": \"role [superuser] is reserved and cannot be deleted\"\n }\n }\n }\n}" x-state: Generally available; Added in 8.15.0 x-metaTags: - content: Elasticsearch name: product_name /_security/api_key/_bulk_update: post: tags: - security summary: Bulk update API keys description: 'Update the attributes for multiple API keys. IMPORTANT: It is not possible to use an API key as the authentication credential for this API. To update API keys, the owner user''s credentials are required. This API is similar to the update API key API but enables you to apply the same update to multiple API keys in one API call. This operation can greatly improve performance over making individual updates. It is not possible to update expired or invalidated API keys. This API supports updates to API key access scope, metadata and expiration. The access scope of each API key is derived from the `role_descriptors` you specify in the request and a snapshot of the owner user''s permissions at the time of the request. The snapshot of the owner''s permissions is updated automatically on every call. IMPORTANT: If you don''t specify `role_descriptors` in the request, a call to this API might still change an API key''s access scope. This change can occur if the owner user''s permissions have changed since the API key was created or last modified. A successful request returns a JSON structure that contains the IDs of all updated API keys, the IDs of API keys that already had the requested changes and did not require an update, and error details for any failed update. ## Required authorization * Cluster privileges: `manage_own_api_key` ' operationId: security-bulk-update-api-keys requestBody: content: application/json: schema: type: object properties: expiration: description: 'Expiration time for the API keys. By default, API keys never expire. This property can be omitted to leave the value unchanged.' allOf: - $ref: '#/components/schemas/_types.Duration' ids: description: The API key identifiers. oneOf: - type: string - type: array items: type: string metadata: description: 'Arbitrary nested metadata to associate with the API keys. Within the `metadata` object, top-level keys beginning with an underscore (`_`) are reserved for system usage. Any information specified with this parameter fully replaces metadata previously associated with the API key.' allOf: - $ref: '#/components/schemas/_types.Metadata' role_descriptors: description: 'The role descriptors to assign to the API keys. An API key''s effective permissions are an intersection of its assigned privileges and the point-in-time snapshot of permissions of the owner user. You can assign new privileges by specifying them in this parameter. To remove assigned privileges, supply the `role_descriptors` parameter as an empty object `{}`. If an API key has no assigned privileges, it inherits the owner user''s full permissions. The snapshot of the owner''s permissions is always updated, whether you supply the `role_descriptors` parameter. The structure of a role descriptor is the same as the request for the create API keys API.' type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' required: - ids examples: SecurityBulkUpdateApiKeysRequestExample1: description: Assign new role descriptors and metadata and update the expiration time for two API keys. value: "{\n \"ids\": [\n \"VuaCfGcBCdbkQm-e5aOx\",\n \"H3_AhoIBA9hmeQJdg7ij\"\n ],\n \"role_descriptors\": {\n \"role-a\": {\n \"indices\": [\n {\n \"names\": [\n \"*\"\n ],\n \"privileges\": [\n \"write\"\n ]\n }\n ]\n }\n },\n \"metadata\": {\n \"environment\": {\n \"level\": 2,\n \"trusted\": true,\n \"tags\": [\n \"production\"\n ]\n }\n },\n \"expiration\": \"30d\"\n}" SecurityBulkUpdateApiKeysRequestExample2: description: Remove the previously assigned permissions for two API keys, making them inherit the owner user's full permissions. value: "{\n \"ids\": [\n \"VuaCfGcBCdbkQm-e5aOx\",\n \"H3_AhoIBA9hmeQJdg7ij\"\n ],\n \"role_descriptors\": {}\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: errors: allOf: - $ref: '#/components/schemas/security._types.BulkError' noops: type: array items: type: string updated: type: array items: type: string required: - noops - updated examples: SecurityBulkUpdateApiKeysResponseExample1: description: A successful response from updating two API keys. value: "{\n \"updated\": [\n \"VuaCfGcBCdbkQm-e5aOx\",\n \"H3_AhoIBA9hmeQJdg7ij\"\n ],\n \"noops\": []\n}" x-state: Generally available; Added in 8.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user/{username}/_password: put: tags: - security summary: Change passwords description: Change the passwords of users in the native realm and built-in users. operationId: security-change-password parameters: - $ref: '#/components/parameters/security.change_password-username' - $ref: '#/components/parameters/security.change_password-refresh' requestBody: $ref: '#/components/requestBodies/security.change_password' responses: '200': $ref: '#/components/responses/security.change_password-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Change passwords description: Change the passwords of users in the native realm and built-in users. operationId: security-change-password-1 parameters: - $ref: '#/components/parameters/security.change_password-username' - $ref: '#/components/parameters/security.change_password-refresh' requestBody: $ref: '#/components/requestBodies/security.change_password' responses: '200': $ref: '#/components/responses/security.change_password-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/user/_password: put: tags: - security summary: Change passwords description: Change the passwords of users in the native realm and built-in users. operationId: security-change-password-2 parameters: - $ref: '#/components/parameters/security.change_password-refresh' requestBody: $ref: '#/components/requestBodies/security.change_password' responses: '200': $ref: '#/components/responses/security.change_password-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Change passwords description: Change the passwords of users in the native realm and built-in users. operationId: security-change-password-3 parameters: - $ref: '#/components/parameters/security.change_password-refresh' requestBody: $ref: '#/components/requestBodies/security.change_password' responses: '200': $ref: '#/components/responses/security.change_password-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/api_key/{ids}/_clear_cache: post: tags: - security summary: Clear the API key cache description: 'Evict a subset of all entries from the API key cache. The cache is also automatically cleared on state changes of the security index. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-clear-api-key-cache parameters: - in: path name: ids description: 'Comma-separated list of API key IDs to evict from the API key cache. To evict all API keys, use `*`. Does not support other wildcard patterns.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: _nodes: allOf: - $ref: '#/components/schemas/_types.NodeStatistics' cluster_name: allOf: - $ref: '#/components/schemas/_types.Name' nodes: type: object additionalProperties: $ref: '#/components/schemas/security._types.ClusterNode' required: - _nodes - cluster_name - nodes x-state: Generally available; Added in 7.10.0 x-metaTags: - content: Elasticsearch name: product_name /_security/privilege/{application}/_clear_cache: post: tags: - security summary: Clear the privileges cache description: 'Evict privileges from the native application privilege cache. The cache is also automatically cleared for applications that have their privileges updated. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-clear-cached-privileges parameters: - in: path name: application description: 'A comma-separated list of applications. To clear all applications, use an asterism (`*`). It does not support other wildcard patterns.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: _nodes: allOf: - $ref: '#/components/schemas/_types.NodeStatistics' cluster_name: allOf: - $ref: '#/components/schemas/_types.Name' nodes: type: object additionalProperties: $ref: '#/components/schemas/security._types.ClusterNode' required: - _nodes - cluster_name - nodes x-state: Generally available; Added in 7.9.0 x-metaTags: - content: Elasticsearch name: product_name /_security/realm/{realms}/_clear_cache: post: tags: - security summary: Clear the user cache description: 'Evict users from the user cache. You can completely clear the cache or evict specific users. User credentials are cached in memory on each node to avoid connecting to a remote authentication service or hitting the disk for every incoming request. There are realm settings that you can use to configure the user cache. For more information, refer to the documentation about controlling the user cache.' externalDocs: description: About controlling the user cache url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-user-cache x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-clear-cache.html operationId: security-clear-cached-realms parameters: - in: path name: realms description: 'A comma-separated list of realms. To clear all realms, use an asterisk (`*`). It does not support other wildcard patterns.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple - in: query name: usernames description: 'A comma-separated list of the users to clear from the cache. If you do not specify this parameter, the API evicts all users from the user cache.' deprecated: false schema: type: array items: type: string style: form responses: '200': description: '' content: application/json: schema: type: object properties: _nodes: allOf: - $ref: '#/components/schemas/_types.NodeStatistics' cluster_name: allOf: - $ref: '#/components/schemas/_types.Name' nodes: type: object additionalProperties: $ref: '#/components/schemas/security._types.ClusterNode' required: - _nodes - cluster_name - nodes x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/role/{name}/_clear_cache: post: tags: - security summary: Clear the roles cache description: 'Evict roles from the native role cache. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-clear-cached-roles parameters: - in: path name: name description: 'A comma-separated list of roles to evict from the role cache. To evict all roles, use an asterisk (`*`). It does not support other wildcard patterns.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: _nodes: allOf: - $ref: '#/components/schemas/_types.NodeStatistics' cluster_name: allOf: - $ref: '#/components/schemas/_types.Name' nodes: type: object additionalProperties: $ref: '#/components/schemas/security._types.ClusterNode' required: - _nodes - cluster_name - nodes x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}/{service}/credential/token/{name}/_clear_cache: post: tags: - security summary: Clear service account token caches description: 'Evict a subset of all entries from the service account token caches. Two separate caches exist for service account tokens: one cache for tokens backed by the `service_tokens` file, and another for tokens backed by the `.security` index. This API clears matching entries from both caches. The cache for service account tokens backed by the `.security` index is cleared automatically on state changes of the security index. The cache for tokens backed by the `service_tokens` file is cleared automatically on file changes. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-clear-service-token-caches.html operationId: security-clear-cached-service-tokens parameters: - in: path name: namespace description: The namespace, which is a top-level grouping of service accounts. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Namespace' style: simple - in: path name: service description: The name of the service, which must be unique within its namespace. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Service' style: simple - in: path name: name description: 'A comma-separated list of token names to evict from the service account token caches. Use a wildcard (`*`) to evict all tokens that belong to a service account. It does not support other wildcard patterns.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: _nodes: allOf: - $ref: '#/components/schemas/_types.NodeStatistics' cluster_name: allOf: - $ref: '#/components/schemas/_types.Name' nodes: type: object additionalProperties: $ref: '#/components/schemas/security._types.ClusterNode' required: - _nodes - cluster_name - nodes x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/api_key/clone: put: tags: - security summary: Clone an API key description: 'Create a copy of an existing API key with a new ID. The cloned key inherits the role descriptors of the source key. This is intended for applications (such as Kibana) that need to create API keys on behalf of a user using an existing API key credential, since derived API keys (API keys created by API keys) are not otherwise supported. ## Required authorization * Cluster privileges: `manage_own_api_key` ' operationId: security-clone-api-key-1 parameters: - $ref: '#/components/parameters/security.clone_api_key-refresh' requestBody: $ref: '#/components/requestBodies/security.clone_api_key' responses: '200': $ref: '#/components/responses/security.clone_api_key-200' x-state: Experimental; Added in 9.4.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Clone an API key description: 'Create a copy of an existing API key with a new ID. The cloned key inherits the role descriptors of the source key. This is intended for applications (such as Kibana) that need to create API keys on behalf of a user using an existing API key credential, since derived API keys (API keys created by API keys) are not otherwise supported. ## Required authorization * Cluster privileges: `manage_own_api_key` ' operationId: security-clone-api-key parameters: - $ref: '#/components/parameters/security.clone_api_key-refresh' requestBody: $ref: '#/components/requestBodies/security.clone_api_key' responses: '200': $ref: '#/components/responses/security.clone_api_key-200' x-state: Experimental; Added in 9.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/api_key: get: tags: - security summary: Get API key information description: 'Retrieves information for one or more API keys. NOTE: If you have only the `manage_own_api_key` privilege, this API returns only the API keys that you own. If you have `read_security`, `manage_api_key` or greater privileges (including `manage_security`), this API returns all API keys regardless of ownership. ## Required authorization * Cluster privileges: `manage_own_api_key`,`read_security` ' operationId: security-get-api-key parameters: - in: query name: id description: 'An API key id. This parameter cannot be used with any of `name`, `realm_name` or `username`.' deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: form - in: query name: name description: 'An API key name. This parameter cannot be used with any of `id`, `realm_name` or `username`. It supports prefix search with wildcard.' deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: form - in: query name: owner description: 'A boolean flag that can be used to query API keys owned by the currently authenticated user. The `realm_name` or `username` parameters cannot be specified when this parameter is set to `true` as they are assumed to be the currently authenticated ones.' deprecated: false schema: default: false type: boolean style: form - in: query name: realm_name description: 'The name of an authentication realm. This parameter cannot be used with either `id` or `name` or when `owner` flag is set to `true`.' deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: form - in: query name: username description: 'The username of a user. This parameter cannot be used with either `id` or `name` or when `owner` flag is set to `true`.' deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: form - in: query name: with_limited_by description: 'Return the snapshot of the owner user''s role descriptors associated with the API key. An API key''s actual permission is the intersection of its assigned role descriptors and the owner user''s role descriptors.' deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.5.0 style: form - in: query name: active_only description: A boolean flag that can be used to query API keys that are currently active. An API key is considered active if it is neither invalidated, nor expired at query time. You can specify this together with other parameters such as `owner` or `name`. If `active_only` is false, the response will include both active and inactive (expired or invalidated) keys. deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.10.0 style: form - in: query name: with_profile_uid description: Determines whether to also retrieve the profile uid, for the API key owner principal, if it exists. deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.14.0 style: form responses: '200': description: '' content: application/json: schema: type: object properties: api_keys: type: array items: $ref: '#/components/schemas/security._types.ApiKey' required: - api_keys examples: SecurityGetApiKeyResponseExample1: summary: Get a key by ID description: A successful response from `GET /_security/api_key?id=VuaCfGcBCdbkQm-e5aOx&with_limited_by=true`. value: "{\n \"api_keys\": [ \n {\n \"id\": \"VuaCfGcBCdbkQm-e5aOx\", \n \"name\": \"my-api-key\", \n \"creation\": 1548550550158, \n \"expiration\": 1548551550158, \n \"invalidated\": false, \n \"username\": \"myuser\", \n \"realm\": \"native1\", \n \"realm_type\": \"native\",\n \"metadata\": { \n \"application\": \"myapp\"\n },\n \"role_descriptors\": { }, \n \"limited_by\": [ \n {\n \"role-power-user\": {\n \"cluster\": [\n \"monitor\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"*\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"allow_restricted_indices\": false\n }\n ],\n \"applications\": [ ],\n \"run_as\": [ ],\n \"metadata\": { },\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n }\n ]\n }\n ]\n}" SecurityGetApiKeyResponseExample2: summary: Get all keys for a user description: 'A successful response from `GET /_security/api_key?username=myuser&realm_name=native1`. The response contains all API keys for the user `myuser` in the `native1` realm. ' value: "{\n \"api_keys\": [\n {\n \"id\": \"0GF5GXsBCXxz2eDxWwFN\",\n \"name\": \"hadoop_myuser_key\",\n \"creation\": 1548550550158,\n \"expiration\": 1548551550158,\n \"invalidated\": false,\n \"username\": \"myuser\",\n \"realm\": \"native1\",\n \"realm_type\": \"native\",\n \"metadata\": {\n \"application\": \"myapp\"\n },\n \"role_descriptors\": {\n \"role-a\": {\n \"cluster\": [\n \"monitor\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index-a\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"allow_restricted_indices\": false\n }\n ],\n \"applications\": [ ],\n \"run_as\": [ ],\n \"metadata\": { },\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n }\n },\n {\n \"id\": \"6wHJmcQpReKBa42EHV5SBw\",\n \"name\": \"api-key-name-2\",\n \"creation\": 1548550550158,\n \"invalidated\": false,\n \"username\": \"user-y\",\n \"realm\": \"realm-2\",\n \"metadata\": {},\n \"role_descriptors\": { }\n }\n ]\n}" x-state: Generally available; Added in 6.7.0 x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Create an API key description: 'Create an API key for access without requiring basic authentication. IMPORTANT: If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error. A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds. NOTE: By default, API keys never expire. You can specify expiration information when you create the API keys. The API keys are created by the Elasticsearch API key service, which is automatically enabled. To configure or turn off the API key service, refer to API key service setting documentation. ## Required authorization * Cluster privileges: `manage_own_api_key` ' externalDocs: description: About API key service settings url: https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/security-settings#api-key-service-settings x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-api-key.html operationId: security-create-api-key parameters: - $ref: '#/components/parameters/security.create_api_key-refresh' requestBody: $ref: '#/components/requestBodies/security.create_api_key' responses: '200': $ref: '#/components/responses/security.create_api_key-200' x-state: Generally available; Added in 6.7.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create an API key description: 'Create an API key for access without requiring basic authentication. IMPORTANT: If the credential that is used to authenticate this request is an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error. A successful request returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds. NOTE: By default, API keys never expire. You can specify expiration information when you create the API keys. The API keys are created by the Elasticsearch API key service, which is automatically enabled. To configure or turn off the API key service, refer to API key service setting documentation. ## Required authorization * Cluster privileges: `manage_own_api_key` ' externalDocs: description: About API key service settings url: https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/security-settings#api-key-service-settings x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-api-key.html operationId: security-create-api-key-1 parameters: - $ref: '#/components/parameters/security.create_api_key-refresh' requestBody: $ref: '#/components/requestBodies/security.create_api_key' responses: '200': $ref: '#/components/responses/security.create_api_key-200' x-state: Generally available; Added in 6.7.0 x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Invalidate API keys description: 'This API invalidates API keys created by the create API key or grant API key APIs. Invalidated API keys fail authentication, but they can still be viewed using the get API key information and query API key information APIs, for at least the configured retention period, until they are automatically deleted. To use this API, you must have at least the `manage_security`, `manage_api_key`, or `manage_own_api_key` cluster privileges. The `manage_security` privilege allows deleting any API key, including both REST and cross cluster API keys. The `manage_api_key` privilege allows deleting any REST API key, but not cross cluster API keys. The `manage_own_api_key` only allows deleting REST API keys that are owned by the user. In addition, with the `manage_own_api_key` privilege, an invalidation request must be issued in one of the three formats: - Set the parameter `owner=true`. - Or, set both `username` and `realm_name` to match the user''s identity. - Or, if the request is issued by an API key, that is to say an API key invalidates itself, specify its ID in the `ids` field. ## Required authorization * Cluster privileges: `manage_api_key`,`manage_own_api_key` ' operationId: security-invalidate-api-key requestBody: content: application/json: schema: type: object properties: id: allOf: - $ref: '#/components/schemas/_types.Id' ids: description: 'A list of API key ids. This parameter cannot be used with any of `name`, `realm_name`, or `username`.' type: array items: $ref: '#/components/schemas/_types.Id' name: description: 'An API key name. This parameter cannot be used with any of `ids`, `realm_name` or `username`.' allOf: - $ref: '#/components/schemas/_types.Name' owner: description: 'Query API keys owned by the currently authenticated user. The `realm_name` or `username` parameters cannot be specified when this parameter is set to `true` as they are assumed to be the currently authenticated ones. NOTE: At least one of `ids`, `name`, `username`, and `realm_name` must be specified if `owner` is `false`.' default: false type: boolean realm_name: description: 'The name of an authentication realm. This parameter cannot be used with either `ids` or `name`, or when `owner` flag is set to `true`.' type: string username: description: 'The username of a user. This parameter cannot be used with either `ids` or `name` or when `owner` flag is set to `true`.' allOf: - $ref: '#/components/schemas/_types.Username' examples: SecurityInvalidateApiKeyRequestExample1: summary: API keys by ID description: Run `DELETE /_security/api_key` to invalidate the API keys identified by ID. value: "{\n \"ids\" : [ \"VuaCfGcBCdbkQm-e5aOx\" ]\n}" SecurityInvalidateApiKeyRequestExample2: summary: API keys by name description: Run `DELETE /_security/api_key` to invalidate the API keys identified by name. value: "{\n \"name\" : \"my-api-key\"\n}" SecurityInvalidateApiKeyRequestExample3: summary: API keys by realm description: Run `DELETE /_security/api_key` to invalidate all API keys for the `native1` realm. value: "{\n \"realm_name\" : \"native1\"\n}" SecurityInvalidateApiKeyRequestExample4: summary: API keys by user description: Run `DELETE /_security/api_key` to invalidate all API keys for the user `myuser` in all realms. value: "{\n \"username\" : \"myuser\"\n}" SecurityInvalidateApiKeyRequestExample5: summary: API keys by ID and owner description: Run `DELETE /_security/api_key` to invalidate the API keys identified by ID if they are owned by the currently authenticated user. value: "{\n \"ids\" : [\"VuaCfGcBCdbkQm-e5aOx\"],\n \"owner\" : \"true\"\n}" SecurityInvalidateApiKeyRequestExample6: summary: API keys by user and realm description: Run `DELETE /_security/api_key` to invalidate all API keys for the user `myuser` in the `native1` realm . value: "{\n \"username\" : \"myuser\",\n \"realm_name\" : \"native1\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: error_count: description: The number of errors that were encountered when invalidating the API keys. type: number error_details: description: 'Details about the errors. This field is not present in the response when `error_count` is `0`.' type: array items: $ref: '#/components/schemas/_types.ErrorCause' invalidated_api_keys: description: The IDs of the API keys that were invalidated as part of this request. type: array items: type: string previously_invalidated_api_keys: description: The IDs of the API keys that were already invalidated. type: array items: type: string required: - error_count - invalidated_api_keys - previously_invalidated_api_keys examples: SecurityInvalidateApiKeyResponseExample1: description: 'A successful response from `DELETE /_security/api_key`. ' value: "{\n \"invalidated_api_keys\": [ \n \"api-key-id-1\"\n ],\n \"previously_invalidated_api_keys\": [ \n \"api-key-id-2\",\n \"api-key-id-3\"\n ],\n \"error_count\": 2, \n \"error_details\": [ \n {\n \"type\": \"exception\",\n \"reason\": \"error occurred while invalidating api keys\",\n \"caused_by\": {\n \"type\": \"illegal_argument_exception\",\n \"reason\": \"invalid api key id\"\n }\n },\n {\n \"type\": \"exception\",\n \"reason\": \"error occurred while invalidating api keys\",\n \"caused_by\": {\n \"type\": \"illegal_argument_exception\",\n \"reason\": \"invalid api key id\"\n }\n }\n ]\n}" x-state: Generally available; Added in 6.7.0 x-metaTags: - content: Elasticsearch name: product_name /_security/cross_cluster/api_key: post: tags: - security summary: Create a cross-cluster API key description: 'Create an API key of the `cross_cluster` type for the API key based remote cluster access. A `cross_cluster` API key cannot be used to authenticate through the REST interface. IMPORTANT: To authenticate this request you must use a credential that is not an API key. Even if you use an API key that has the required privilege, the API returns an error. Cross-cluster API keys are created by the Elasticsearch API key service, which is automatically enabled. NOTE: Unlike REST API keys, a cross-cluster API key does not capture permissions of the authenticated user. The API key’s effective permission is exactly as specified with the `access` property. A successful request returns a JSON structure that contains the API key, its unique ID, and its name. If applicable, it also returns expiration information for the API key in milliseconds. By default, API keys never expire. You can specify expiration information when you create the API keys. Cross-cluster API keys can only be updated with the update cross-cluster API key API. Attempting to update them with the update REST API key API or the bulk update REST API keys API will result in an error. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About adding remote clusters url: https://www.elastic.co/docs/deploy-manage/remote-clusters/remote-clusters-api-key x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-cross-cluster-api-key.html operationId: security-create-cross-cluster-api-key requestBody: content: application/json: schema: type: object properties: access: description: 'The access to be granted to this API key. The access is composed of permissions for cross-cluster search and cross-cluster replication. At least one of them must be specified. NOTE: No explicit privileges should be specified for either search or replication access. The creation process automatically converts the access specification to a role descriptor which has relevant privileges assigned accordingly.' allOf: - $ref: '#/components/schemas/security._types.Access' expiration: description: 'Expiration time for the API key. By default, API keys never expire.' allOf: - $ref: '#/components/schemas/_types.Duration' metadata: description: 'Arbitrary metadata that you want to associate with the API key. It supports nested data structure. Within the metadata object, keys beginning with `_` are reserved for system usage.' allOf: - $ref: '#/components/schemas/_types.Metadata' name: description: Specifies the name for this API key. allOf: - $ref: '#/components/schemas/_types.Name' certificate_identity: description: 'The certificate identity to associate with this API key. This field is used to restrict the API key to connections authenticated by a specific TLS certificate. The value should match the certificate''s distinguished name (DN) pattern.' type: string required: - access - name examples: CreateCrossClusterApiKeyRequestExample1: description: 'Run `POST /_security/cross_cluster/api_key` to create a cross-cluster API key. ' value: "{\n \"name\": \"my-cross-cluster-api-key\",\n \"expiration\": \"1d\", \n \"access\": {\n \"search\": [ \n {\n \"names\": [\"logs*\"]\n }\n ],\n \"replication\": [ \n {\n \"names\": [\"archive*\"]\n }\n ]\n },\n \"metadata\": {\n \"description\": \"phase one\",\n \"environment\": {\n \"level\": 1,\n \"trusted\": true,\n \"tags\": [\"dev\", \"staging\"]\n }\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: api_key: description: Generated API key. type: string expiration: description: Expiration in milliseconds for the API key. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' id: description: Unique ID for this API key. allOf: - $ref: '#/components/schemas/_types.Id' name: description: Specifies the name for this API key. allOf: - $ref: '#/components/schemas/_types.Name' encoded: description: 'API key credentials which is the base64-encoding of the UTF-8 representation of `id` and `api_key` joined by a colon (`:`).' type: string required: - api_key - id - name - encoded examples: CreateCrossClusterApiKeyResponseExample1: description: 'A successful response from `POST /_security/service/elastic/fleet-server/credential/token`. ' value: "{\n \"created\": true,\n \"token\": {\n \"name\": \"Jk5J1HgBuyBK5TpDrdo4\",\n \"value\": \"AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ\"\n }\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}/{service}/credential/token/{name}: put: tags: - security summary: Create a service account token description: 'Create a service accounts token for access without requiring basic authentication. NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed. IMPORTANT: On Serverless, non-operator users can create tokens for only `elastic/fleet-server` and `elastic/fleet-server-remote`. Creating tokens for any other service account requires operator privileges. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-service-token.html operationId: security-create-service-token parameters: - $ref: '#/components/parameters/security.create_service_token-namespace' - $ref: '#/components/parameters/security.create_service_token-service' - $ref: '#/components/parameters/security.create_service_token-name' - $ref: '#/components/parameters/security.create_service_token-refresh' responses: '200': $ref: '#/components/responses/security.create_service_token-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create a service account token description: 'Create a service accounts token for access without requiring basic authentication. NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed. IMPORTANT: On Serverless, non-operator users can create tokens for only `elastic/fleet-server` and `elastic/fleet-server-remote`. Creating tokens for any other service account requires operator privileges. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-service-token.html operationId: security-create-service-token-1 parameters: - $ref: '#/components/parameters/security.create_service_token-namespace' - $ref: '#/components/parameters/security.create_service_token-service' - $ref: '#/components/parameters/security.create_service_token-name' - $ref: '#/components/parameters/security.create_service_token-refresh' responses: '200': $ref: '#/components/responses/security.create_service_token-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Delete service account tokens description: 'Delete service account tokens for a service in a specified namespace. IMPORTANT: On Serverless, non-operator users can delete tokens for only `elastic/fleet-server` and `elastic/fleet-server-remote`. Deleting tokens for any other service account requires operator privileges. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-delete-service-token.html operationId: security-delete-service-token parameters: - in: path name: namespace description: The namespace, which is a top-level grouping of service accounts. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Namespace' style: simple - in: path name: service description: The service name. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Service' style: simple - in: path name: name description: The name of the service account token. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form responses: '200': description: '' content: application/json: schema: type: object properties: found: description: 'If the service account token is successfully deleted, the request returns `{"found": true}`. Otherwise, the response will have status code 404 and `found` is set to `false`.' type: boolean required: - found examples: DeleteServiceTokenResponseExample1: description: 'A successful response from `DELETE /_security/service/elastic/fleet-server/credential/token/token42`. ' value: "{\n \"found\" : true\n}" x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}/{service}/credential/token: post: tags: - security summary: Create a service account token description: 'Create a service accounts token for access without requiring basic authentication. NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed. IMPORTANT: On Serverless, non-operator users can create tokens for only `elastic/fleet-server` and `elastic/fleet-server-remote`. Creating tokens for any other service account requires operator privileges. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-create-service-token.html operationId: security-create-service-token-2 parameters: - $ref: '#/components/parameters/security.create_service_token-namespace' - $ref: '#/components/parameters/security.create_service_token-service' - $ref: '#/components/parameters/security.create_service_token-refresh' responses: '200': $ref: '#/components/responses/security.create_service_token-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/delegate_pki: post: tags: - security summary: Delegate PKI authentication description: 'This API implements the exchange of an X509Certificate chain for an Elasticsearch access token. The certificate chain is validated, according to RFC 5280, by sequentially considering the trust configuration of every installed PKI realm that has `delegation.enabled` set to `true`. A successfully trusted client certificate is also subject to the validation of the subject distinguished name according to thw `username_pattern` of the respective realm. This API is called by smart and trusted proxies, such as Kibana, which terminate the user''s TLS session but still want to authenticate the user by using a PKI realm—-​as if the user connected directly to Elasticsearch. IMPORTANT: The association between the subject public key in the target certificate and the corresponding private key is not validated. This is part of the TLS authentication process and it is delegated to the proxy that calls this API. The proxy is trusted to have performed the TLS authentication and this API translates that authentication into an Elasticsearch access token. ## Required authorization * Cluster privileges: `all` ' externalDocs: description: Learn more about pki url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/pki x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-delegate-pki-authentication.html operationId: security-delegate-pki requestBody: content: application/json: schema: type: object properties: x509_certificate_chain: description: 'The X509Certificate chain, which is represented as an ordered string array. Each string in the array is a base64-encoded (Section 4 of RFC4648 - not base64url-encoded) of the certificate''s DER encoding. The first element is the target certificate that contains the subject distinguished name that is requesting access. This may be followed by additional certificates; each subsequent certificate is used to certify the previous one.' type: array items: type: string required: - x509_certificate_chain examples: SecurityDelegatePkiRequestExample1: description: Delegate a one element certificate chain. value: '{ "x509_certificate_chain": ["MIIDeDCCAmCgAwIBAgIUBzj/nGGKxP2iXawsSquHmQjCJmMwDQYJKoZIhvcNAQELBQAwUzErMCkGA1UEAxMiRWxhc3RpY3NlYXJjaCBUZXN0IEludGVybWVkaWF0ZSBDQTEWMBQGA1UECxMNRWxhc3RpY3NlYXJjaDEMMAoGA1UEChMDb3JnMB4XDTIzMDcxODE5MjkwNloXDTQzMDcxMzE5MjkwNlowSjEiMCAGA1UEAxMZRWxhc3RpY3NlYXJjaCBUZXN0IENsaWVudDEWMBQGA1UECxMNRWxhc3RpY3NlYXJjaDEMMAoGA1UEChMDb3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAllHL4pQkkfwAm/oLkxYYO+r950DEy1bjH+4viCHzNADLCTWO+lOZJVlNx7QEzJE3QGMdif9CCBBxQFMapA7oUFCLq84fPSQQu5AnvvbltVD9nwVtCs+9ZGDjMKsz98RhSLMFIkxdxi6HkQ3Lfa4ZSI4lvba4oo+T/GveazBDS+NgmKyq00EOXt3tWi1G9vEVItommzXWfv0agJWzVnLMldwkPqsw0W7zrpyT7FZS4iLbQADGceOW8fiauOGMkscu9zAnDR/SbWl/chYioQOdw6ndFLn1YIFPd37xL0WsdsldTpn0vH3YfzgLMffT/3P6YlwBegWzsx6FnM/93Ecb4wIDAQABo00wSzAJBgNVHRMEAjAAMB0GA1UdDgQWBBQKNRwjW+Ad/FN1Rpoqme/5+jrFWzAfBgNVHSMEGDAWgBRcya0c0x/PaI7MbmJVIylWgLqXNjANBgkqhkiG9w0BAQsFAAOCAQEACZ3PF7Uqu47lplXHP6YlzYL2jL0D28hpj5lGtdha4Muw1m/BjDb0Pu8l0NQ1z3AP6AVcvjNDkQq6Y5jeSz0bwQlealQpYfo7EMXjOidrft1GbqOMFmTBLpLA9SvwYGobSTXWTkJzonqVaTcf80HpMgM2uEhodwTcvz6v1WEfeT/HMjmdIsq4ImrOL9RNrcZG6nWfw0HR3JNOgrbfyEztEI471jHznZ336OEcyX7gQuvHE8tOv5+oD1d7s3Xg1yuFp+Ynh+FfOi3hPCuaHA+7F6fLmzMDLVUBAllugst1C3U+L/paD7tqIa4ka+KNPCbSfwazmJrt4XNiivPR4hwH5g=="] }' required: true responses: '200': description: '' content: application/json: schema: type: object properties: access_token: description: An access token associated with the subject distinguished name of the client's certificate. type: string expires_in: description: The amount of time (in seconds) before the token expires. type: number type: description: The type of token. type: string authentication: allOf: - $ref: '#/components/schemas/security.delegate_pki.Authentication' required: - access_token - expires_in - type examples: SecurityDelegatePkiResponseExample1: description: A successful response from delegating a one element certificate chain. value: "{\n \"access_token\": \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\",\n \"type\": \"Bearer\",\n \"expires_in\": 1200,\n \"authentication\": {\n \"username\": \"Elasticsearch Test Client\",\n \"roles\": [],\n \"full_name\": null,\n \"email\": null,\n \"metadata\": {\n \"pki_dn\": \"O=org, OU=Elasticsearch, CN=Elasticsearch Test Client\",\n \"pki_delegated_by_user\": \"test_admin\",\n \"pki_delegated_by_realm\": \"file\"\n },\n \"enabled\": true,\n \"authentication_realm\": {\n \"name\": \"pki1\",\n \"type\": \"pki\"\n },\n \"lookup_realm\": {\n \"name\": \"pki1\",\n \"type\": \"pki\"\n },\n \"authentication_type\": \"realm\"\n }\n}" x-state: Generally available; Added in 7.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/privilege/{application}/{name}: get: tags: - security summary: Get application privileges description: 'To use this API, you must have one of the following privileges: * The `read_security` cluster privilege (or a greater privilege such as `manage_security` or `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-privileges.html operationId: security-get-privileges-2 parameters: - $ref: '#/components/parameters/security.get_privileges-application' - $ref: '#/components/parameters/security.get_privileges-name' responses: '200': $ref: '#/components/responses/security.get_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Delete application privileges description: 'To use this API, you must have one of the following privileges: * The `manage_security` cluster privilege (or a greater privilege such as `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-delete-privilege.html operationId: security-delete-privileges parameters: - in: path name: application description: 'The name of the application. Application privileges are always associated with exactly one application.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple - in: path name: name description: The name of the privilege. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form responses: '200': description: '' content: application/json: schema: type: object additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/security.delete_privileges.FoundStatus' examples: SecurityDeletePrivilegesResponseExample1: description: 'A successful response from `DELETE /_security/privilege/myapp/read`. If the privilege is successfully deleted, `found` is set to `true`. ' value: "{\n \"myapp\": {\n \"read\": {\n \"found\" : true\n }\n }\n}" x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/role/{name}: get: tags: - security summary: Get roles description: 'Get roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The get roles API cannot retrieve roles that are defined in roles files. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-role parameters: - $ref: '#/components/parameters/security.get_role-name' - $ref: '#/components/parameters/security.get_role-include_implicit' responses: '200': $ref: '#/components/responses/security.get_role-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Create or update roles description: 'The role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management. The create or update roles API cannot update roles that are defined in roles files. File-based role management is not available in Elastic Serverless. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: More about defining roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-role.html operationId: security-put-role parameters: - $ref: '#/components/parameters/security.put_role-name' - $ref: '#/components/parameters/security.put_role-refresh' requestBody: $ref: '#/components/requestBodies/security.put_role' responses: '200': $ref: '#/components/responses/security.put_role-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create or update roles description: 'The role management APIs are generally the preferred way to manage roles in the native realm, rather than using file-based role management. The create or update roles API cannot update roles that are defined in roles files. File-based role management is not available in Elastic Serverless. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: More about defining roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-role.html operationId: security-put-role-1 parameters: - $ref: '#/components/parameters/security.put_role-name' - $ref: '#/components/parameters/security.put_role-refresh' requestBody: $ref: '#/components/requestBodies/security.put_role' responses: '200': $ref: '#/components/responses/security.put_role-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Delete roles description: 'Delete roles in the native realm. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The delete roles API cannot remove roles that are defined in roles files. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-delete-role parameters: - in: path name: name description: The name of the role. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form responses: '200': description: '' content: application/json: schema: type: object properties: found: description: 'If the role is successfully deleted, `found` is `true`. Otherwise, `found` is `false`.' type: boolean required: - found examples: SecurityDeleteRoleResponseExample1: description: 'A successful response from `DELETE /_security/role/my_admin_role`. If the role is successfully deleted, `found` is set to `true`. ' value: "{\n \"found\" : true\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/role_mapping/{name}: get: tags: - security summary: Get role mappings description: 'Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The get role mappings API cannot retrieve role mappings that are defined in role mapping files. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About mapping users to roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-role-mapping.html operationId: security-get-role-mapping parameters: - $ref: '#/components/parameters/security.get_role_mapping-name' responses: '200': $ref: '#/components/responses/security.get_role_mapping-200' x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Create or update role mappings description: 'Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files. NOTE: This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using the create or update roles API or roles files. **Role templates** The most common use for role mappings is to create a mapping from a known value on the user to a fixed role name. For example, all users in the `cn=admin,dc=example,dc=com` LDAP group should be given the superuser role in Elasticsearch. The `roles` field is used for this purpose. For more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user. The `role_templates` field is used for this purpose. NOTE: To use role templates successfully, the relevant scripting feature must be enabled. Otherwise, all attempts to create a role mapping with role templates fail. All of the user fields that are available in the role mapping rules are also available in the role templates. Thus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated. By default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user. If the format of the template is set to "json" then the template is expected to produce a JSON string or an array of JSON strings for the role names. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About mapping users to roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-role-mapping.html operationId: security-put-role-mapping parameters: - $ref: '#/components/parameters/security.put_role_mapping-name' - $ref: '#/components/parameters/security.put_role_mapping-refresh' requestBody: $ref: '#/components/requestBodies/security.put_role_mapping' responses: '200': $ref: '#/components/responses/security.put_role_mapping-200' x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create or update role mappings description: 'Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files. NOTE: This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using the create or update roles API or roles files. **Role templates** The most common use for role mappings is to create a mapping from a known value on the user to a fixed role name. For example, all users in the `cn=admin,dc=example,dc=com` LDAP group should be given the superuser role in Elasticsearch. The `roles` field is used for this purpose. For more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user. The `role_templates` field is used for this purpose. NOTE: To use role templates successfully, the relevant scripting feature must be enabled. Otherwise, all attempts to create a role mapping with role templates fail. All of the user fields that are available in the role mapping rules are also available in the role templates. Thus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated. By default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user. If the format of the template is set to "json" then the template is expected to produce a JSON string or an array of JSON strings for the role names. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About mapping users to roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-role-mapping.html operationId: security-put-role-mapping-1 parameters: - $ref: '#/components/parameters/security.put_role_mapping-name' - $ref: '#/components/parameters/security.put_role_mapping-refresh' requestBody: $ref: '#/components/requestBodies/security.put_role_mapping' responses: '200': $ref: '#/components/responses/security.put_role_mapping-200' x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Delete role mappings description: 'Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The delete role mappings API cannot remove role mappings that are defined in role mapping files. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About mapping users to roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-delete-role-mapping.html operationId: security-delete-role-mapping parameters: - in: path name: name description: 'The distinct name that identifies the role mapping. The name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form responses: '200': description: '' content: application/json: schema: type: object properties: found: description: 'If the mapping is successfully deleted, `found` is `true`. Otherwise, `found` is `false`.' type: boolean required: - found examples: SecurityDeleteRoleMappingResponseExample1: description: 'A successful response from `DELETE /_security/role_mapping/mapping1`. If the mapping is successfully deleted, `found` is `true`. ' value: "{\n \"found\" : true\n}" x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user/{username}: get: tags: - security summary: Get users description: 'Get information about users in the native realm and built-in users. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-user parameters: - $ref: '#/components/parameters/security.get_user-username' - $ref: '#/components/parameters/security.get_user-with_profile_uid' responses: '200': $ref: '#/components/responses/security.get_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Create or update users description: 'Add and update users in the native realm. A password is required for adding a new user but is optional when updating an existing user. To change a user''s password without updating any other fields, use the change password API. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-put-user parameters: - $ref: '#/components/parameters/security.put_user-username' - $ref: '#/components/parameters/security.put_user-refresh' requestBody: $ref: '#/components/requestBodies/security.put_user' responses: '200': $ref: '#/components/responses/security.put_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create or update users description: 'Add and update users in the native realm. A password is required for adding a new user but is optional when updating an existing user. To change a user''s password without updating any other fields, use the change password API. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-put-user-1 parameters: - $ref: '#/components/parameters/security.put_user-username' - $ref: '#/components/parameters/security.put_user-refresh' requestBody: $ref: '#/components/requestBodies/security.put_user' responses: '200': $ref: '#/components/responses/security.put_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Delete users description: 'Delete users from the native realm. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-delete-user parameters: - in: path name: username description: An identifier for the user. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: simple - in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form responses: '200': description: '' content: application/json: schema: type: object properties: found: description: 'If the user is successfully deleted, the request returns `{"found": true}`. Otherwise, `found` is set to `false`.' type: boolean required: - found examples: SecurityDeleteUserResponseExample1: description: 'A successful response from `DELETE /_security/user/jacknich`. ' value: "{\n \"found\" : true\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/user/{username}/_disable: put: tags: - security summary: Disable users description: 'Disable users in the native realm. By default, when you create users, they are enabled. You can use this API to revoke a user''s access to Elasticsearch. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-disable-user parameters: - $ref: '#/components/parameters/security.disable_user-username' - $ref: '#/components/parameters/security.disable_user-refresh' responses: '200': $ref: '#/components/responses/security.disable_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Disable users description: 'Disable users in the native realm. By default, when you create users, they are enabled. You can use this API to revoke a user''s access to Elasticsearch. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-disable-user-1 parameters: - $ref: '#/components/parameters/security.disable_user-username' - $ref: '#/components/parameters/security.disable_user-refresh' responses: '200': $ref: '#/components/responses/security.disable_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/profile/{uid}/_disable: put: tags: - security summary: Disable a user profile description: 'Disable user profiles so that they are not visible in user profile searches. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. When you activate a user profile, its automatically enabled and visible in user profile searches. You can use the disable user profile API to disable a user profile so it’s not visible in these searches. To re-enable a disabled user profile, use the enable user profile API . ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-disable-user-profile parameters: - $ref: '#/components/parameters/security.disable_user_profile-uid' - $ref: '#/components/parameters/security.disable_user_profile-refresh' responses: '200': $ref: '#/components/responses/security.disable_user_profile-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Disable a user profile description: 'Disable user profiles so that they are not visible in user profile searches. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. When you activate a user profile, its automatically enabled and visible in user profile searches. You can use the disable user profile API to disable a user profile so it’s not visible in these searches. To re-enable a disabled user profile, use the enable user profile API . ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-disable-user-profile-1 parameters: - $ref: '#/components/parameters/security.disable_user_profile-uid' - $ref: '#/components/parameters/security.disable_user_profile-refresh' responses: '200': $ref: '#/components/responses/security.disable_user_profile-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user/{username}/_enable: put: tags: - security summary: Enable users description: 'Enable users in the native realm. By default, when you create users, they are enabled. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-enable-user parameters: - $ref: '#/components/parameters/security.enable_user-username' - $ref: '#/components/parameters/security.enable_user-refresh' responses: '200': $ref: '#/components/responses/security.enable_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Enable users description: 'Enable users in the native realm. By default, when you create users, they are enabled. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-enable-user-1 parameters: - $ref: '#/components/parameters/security.enable_user-username' - $ref: '#/components/parameters/security.enable_user-refresh' responses: '200': $ref: '#/components/responses/security.enable_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/profile/{uid}/_enable: put: tags: - security summary: Enable a user profile description: 'Enable user profiles to make them visible in user profile searches. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. When you activate a user profile, it''s automatically enabled and visible in user profile searches. If you later disable the user profile, you can use the enable user profile API to make the profile visible in these searches again. ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-enable-user-profile parameters: - $ref: '#/components/parameters/security.enable_user_profile-uid' - $ref: '#/components/parameters/security.enable_user_profile-refresh' responses: '200': $ref: '#/components/responses/security.enable_user_profile-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Enable a user profile description: 'Enable user profiles to make them visible in user profile searches. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. When you activate a user profile, it''s automatically enabled and visible in user profile searches. If you later disable the user profile, you can use the enable user profile API to make the profile visible in these searches again. ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-enable-user-profile-1 parameters: - $ref: '#/components/parameters/security.enable_user_profile-uid' - $ref: '#/components/parameters/security.enable_user_profile-refresh' responses: '200': $ref: '#/components/responses/security.enable_user_profile-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/enroll/kibana: get: tags: - security summary: Enroll Kibana description: 'Enable a Kibana instance to configure itself for communication with a secured Elasticsearch cluster. NOTE: This API is currently intended for internal use only by Kibana. Kibana uses this API internally to configure itself for communications with an Elasticsearch cluster that already has security features enabled.' operationId: security-enroll-kibana responses: '200': description: '' content: application/json: schema: type: object properties: token: allOf: - $ref: '#/components/schemas/security.enroll_kibana.Token' http_ca: description: 'The CA certificate used to sign the node certificates that Elasticsearch uses for TLS on the HTTP layer. The certificate is returned as a Base64 encoded string of the ASN.1 DER encoding of the certificate.' type: string required: - token - http_ca examples: EnrollKibanaResponseExample1: description: A successful response from `GET /_security/enroll/kibana`. value: "{\n \"token\" : {\n \"name\" : \"enroll-process-token-1629123923000\", \n \"value\": \"AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ\" \n },\n \"http_ca\" : \"MIIJlAIBAzVoGCSqGSIb3...vsDfsA3UZBAjEPfhubpQysAICAA=\", \n}" x-state: Generally available; Added in 8.0.0 x-metaTags: - content: Elasticsearch name: product_name /_security/enroll/node: get: tags: - security summary: Enroll a node description: 'Enroll a new node to allow it to join an existing cluster with security features enabled. The response contains all the necessary information for the joining node to bootstrap discovery and security related settings so that it can successfully join the cluster. The response contains key and certificate material that allows the caller to generate valid signed certificates for the HTTP layer of all nodes in the cluster.' operationId: security-enroll-node responses: '200': description: '' content: application/json: schema: type: object properties: http_ca_key: description: The CA private key that can be used by the new node in order to sign its certificate for the HTTP layer, as a Base64 encoded string of the ASN.1 DER encoding of the key. type: string http_ca_cert: description: The CA certificate that can be used by the new node in order to sign its certificate for the HTTP layer, as a Base64 encoded string of the ASN.1 DER encoding of the certificate. type: string transport_ca_cert: description: The CA certificate that is used to sign the TLS certificate for the transport layer, as a Base64 encoded string of the ASN.1 DER encoding of the certificate. type: string transport_key: description: The private key that the node can use for TLS for its transport layer, as a Base64 encoded string of the ASN.1 DER encoding of the key. type: string transport_cert: description: The certificate that the node can use for TLS for its transport layer, as a Base64 encoded string of the ASN.1 DER encoding of the certificate. type: string nodes_addresses: description: A list of transport addresses in the form of `host:port` for the nodes that are already members of the cluster. type: array items: type: string required: - http_ca_key - http_ca_cert - transport_ca_cert - transport_key - transport_cert - nodes_addresses examples: EnrollNodeResponseExample1: description: A successful response from `PGET /security/enroll/node`. value: "{\n \"http_ca_key\" : \"MIIJlAIBAzCCCVoGCSqGSIb3DQEHAaCCCUsEgglHMIIJQzCCA98GCSqGSIb3DQ....vsDfsA3UZBAjEPfhubpQysAICCAA=\", \n \"http_ca_cert\" : \"MIIJlAIBAzCCCVoGCSqGSIb3DQEHAaCCCUsEgglHMIIJQzCCA98GCSqGSIb3DQ....vsDfsA3UZBAjEPfhubpQysAICCAA=\", \n \"transport_ca_cert\" : \"MIIJlAIBAzCCCVoGCSqGSIb3DQEHAaCCCUsEgglHMIIJQzCCA98GCSqG....vsDfsA3UZBAjEPfhubpQysAICCAA=\", \n \"transport_key\" : \"MIIEJgIBAzCCA98GCSqGSIb3DQEHAaCCA9AEggPMMIIDyDCCA8QGCSqGSIb3....YuEiOXvqZ6jxuVSQ0CAwGGoA==\", \n \"transport_cert\" : \"MIIEJgIBAzCCA98GCSqGSIb3DQEHAaCCA9AEggPMMIIDyDCCA8QGCSqGSIb3....YuEiOXvqZ6jxuVSQ0CAwGGoA==\", \n \"nodes_addresses\" : [ \n \"192.168.1.2:9300\"\n ]\n}" x-state: Generally available; Added in 8.0.0 x-metaTags: - content: Elasticsearch name: product_name /_security/privilege/_builtin: get: tags: - security summary: Get builtin privileges description: 'Get the list of cluster privileges and index privileges that are available in this version of Elasticsearch. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-builtin-privileges.html operationId: security-get-builtin-privileges responses: '200': description: '' content: application/json: schema: type: object properties: cluster: description: The list of cluster privileges that are understood by this version of Elasticsearch. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' index: description: The list of index privileges that are understood by this version of Elasticsearch. type: array items: $ref: '#/components/schemas/_types.IndexName' remote_cluster: description: The list of remote_cluster privileges that are understood by this version of Elasticsearch. x-state: Generally available; Added in 8.15.0 type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivilege' required: - cluster - index - remote_cluster examples: SecurityGetBuiltinPrivilegesResponseExample1: description: A successful response from `GET /_security/privilege/_builtin`. value: "{\n \"cluster\" : [\n \"all\",\n \"cancel_task\",\n \"create_snapshot\",\n \"cross_cluster_replication\",\n \"cross_cluster_search\",\n \"delegate_pki\",\n \"grant_api_key\",\n \"manage\",\n \"manage_api_key\",\n \"manage_autoscaling\",\n \"manage_behavioral_analytics\",\n \"manage_ccr\",\n \"manage_connector\",\n \"manage_data_frame_transforms\",\n \"manage_data_stream_global_retention\",\n \"manage_enrich\",\n \"manage_ilm\",\n \"manage_index_templates\",\n \"manage_inference\",\n \"manage_ingest_pipelines\",\n \"manage_logstash_pipelines\",\n \"manage_ml\",\n \"manage_oidc\",\n \"manage_own_api_key\",\n \"manage_pipeline\",\n \"manage_rollup\",\n \"manage_saml\",\n \"manage_search_application\",\n \"manage_search_query_rules\",\n \"manage_search_synonyms\",\n \"manage_security\",\n \"manage_service_account\",\n \"manage_slm\",\n \"manage_token\",\n \"manage_transform\",\n \"manage_user_profile\",\n \"manage_watcher\",\n \"monitor\",\n \"monitor_connector\",\n \"monitor_data_frame_transforms\",\n \"monitor_data_stream_global_retention\",\n \"monitor_enrich\",\n \"monitor_inference\",\n \"monitor_ml\",\n \"monitor_rollup\",\n \"monitor_snapshot\",\n \"monitor_stats\",\n \"monitor_text_structure\",\n \"monitor_transform\",\n \"monitor_watcher\",\n \"none\",\n \"post_behavioral_analytics_event\",\n \"read_ccr\",\n \"read_connector_secrets\",\n \"read_fleet_secrets\",\n \"read_ilm\",\n \"read_pipeline\",\n \"read_security\",\n \"read_slm\",\n \"transport_client\",\n \"write_connector_secrets\",\n \"write_fleet_secrets\"\n ],\n \"index\" : [\n \"all\",\n \"auto_configure\",\n \"create\",\n \"create_doc\",\n \"create_index\",\n \"cross_cluster_replication\",\n \"cross_cluster_replication_internal\",\n \"delete\",\n \"delete_index\",\n \"index\",\n \"maintenance\",\n \"manage\",\n \"manage_data_stream_lifecycle\",\n \"manage_follow_index\",\n \"manage_ilm\",\n \"manage_leader_index\",\n \"monitor\",\n \"none\",\n \"read\",\n \"read_cross_cluster\",\n \"view_index_metadata\",\n \"write\"\n ],\n \"remote_cluster\" : [\n \"monitor_enrich\",\n \"monitor_stats\"\n ]\n}" x-state: Generally available; Added in 7.3.0 x-metaTags: - content: Elasticsearch name: product_name /_security/privilege: get: tags: - security summary: Get application privileges description: 'To use this API, you must have one of the following privileges: * The `read_security` cluster privilege (or a greater privilege such as `manage_security` or `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-privileges.html operationId: security-get-privileges responses: '200': $ref: '#/components/responses/security.get_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Create or update application privileges description: 'To use this API, you must have one of the following privileges: * The `manage_security` cluster privilege (or a greater privilege such as `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. Application names are formed from a prefix, with an optional suffix that conform to the following rules: * The prefix must begin with a lowercase ASCII letter. * The prefix must contain only ASCII letters or digits. * The prefix must be at least 3 characters long. * If the suffix exists, it must begin with either a dash `-` or `_`. * The suffix cannot contain any of the following characters: `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, `,`, `*`. * No part of the name can contain whitespace. Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters `_`, `-`, and `.`. Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: `/`, `*`, `:`. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-privileges.html operationId: security-put-privileges parameters: - $ref: '#/components/parameters/security.put_privileges-refresh' requestBody: $ref: '#/components/requestBodies/security.put_privileges' responses: '200': $ref: '#/components/responses/security.put_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Create or update application privileges description: 'To use this API, you must have one of the following privileges: * The `manage_security` cluster privilege (or a greater privilege such as `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. Application names are formed from a prefix, with an optional suffix that conform to the following rules: * The prefix must begin with a lowercase ASCII letter. * The prefix must contain only ASCII letters or digits. * The prefix must be at least 3 characters long. * If the suffix exists, it must begin with either a dash `-` or `_`. * The suffix cannot contain any of the following characters: `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, `,`, `*`. * No part of the name can contain whitespace. Privilege names must begin with a lowercase ASCII letter and must contain only ASCII letters and digits along with the characters `_`, `-`, and `.`. Action names can contain any number of printable ASCII characters and must contain at least one of the following characters: `/`, `*`, `:`. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-put-privileges.html operationId: security-put-privileges-1 parameters: - $ref: '#/components/parameters/security.put_privileges-refresh' requestBody: $ref: '#/components/requestBodies/security.put_privileges' responses: '200': $ref: '#/components/responses/security.put_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/privilege/{application}: get: tags: - security summary: Get application privileges description: 'To use this API, you must have one of the following privileges: * The `read_security` cluster privilege (or a greater privilege such as `manage_security` or `all`). * The "Manage Application Privileges" global privilege for the application being referenced in the request. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-privileges.html operationId: security-get-privileges-1 parameters: - $ref: '#/components/parameters/security.get_privileges-application' responses: '200': $ref: '#/components/responses/security.get_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/role_mapping: get: tags: - security summary: Get role mappings description: 'Role mappings define which roles are assigned to each user. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The get role mappings API cannot retrieve role mappings that are defined in role mapping files. ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About mapping users to roles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-role-mapping.html operationId: security-get-role-mapping-1 responses: '200': $ref: '#/components/responses/security.get_role_mapping-200' x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}/{service}: get: tags: - security summary: Get service accounts description: 'Get a list of service accounts that match the provided path parameters. NOTE: Currently, only the `elastic/fleet-server` service account is available. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-service-accounts.html operationId: security-get-service-accounts parameters: - $ref: '#/components/parameters/security.get_service_accounts-namespace' - $ref: '#/components/parameters/security.get_service_accounts-service' responses: '200': $ref: '#/components/responses/security.get_service_accounts-200' x-state: Generally available; Added in 7.13.0 x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}: get: tags: - security summary: Get service accounts description: 'Get a list of service accounts that match the provided path parameters. NOTE: Currently, only the `elastic/fleet-server` service account is available. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-service-accounts.html operationId: security-get-service-accounts-1 parameters: - $ref: '#/components/parameters/security.get_service_accounts-namespace' responses: '200': $ref: '#/components/responses/security.get_service_accounts-200' x-state: Generally available; Added in 7.13.0 x-metaTags: - content: Elasticsearch name: product_name /_security/service: get: tags: - security summary: Get service accounts description: 'Get a list of service accounts that match the provided path parameters. NOTE: Currently, only the `elastic/fleet-server` service account is available. ## Required authorization * Cluster privileges: `manage_service_account` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-service-accounts.html operationId: security-get-service-accounts-2 responses: '200': $ref: '#/components/responses/security.get_service_accounts-200' x-state: Generally available; Added in 7.13.0 x-metaTags: - content: Elasticsearch name: product_name /_security/service/{namespace}/{service}/credential: get: tags: - security summary: Get service account credentials description: 'To use this API, you must have at least the `read_security` cluster privilege (or a greater privilege such as `manage_service_account` or `manage_security`). The response includes service account tokens that were created with the create service account tokens API as well as file-backed tokens from all nodes of the cluster. NOTE: For tokens backed by the `service_tokens` file, the API collects them from all nodes of the cluster. Tokens with the same name from different nodes are assumed to be the same token and are only counted once towards the total number of service tokens. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: More about service accounts url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-service-credentials.html operationId: security-get-service-credentials parameters: - in: path name: namespace description: The name of the namespace. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Namespace' style: simple - in: path name: service description: The service name. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: service_account: type: string count: type: number tokens: type: object additionalProperties: $ref: '#/components/schemas/_types.Metadata' nodes_credentials: description: Service account credentials collected from all nodes of the cluster. allOf: - $ref: '#/components/schemas/security.get_service_credentials.NodesCredentials' required: - service_account - count - tokens - nodes_credentials examples: GetServiceCredentialsResponseExample1: description: 'A successful response from `GET /_security/service/elastic/fleet-server/credential`. The response contains all credentials for the `elastic/fleet-server` service account. ' value: "{\n \"service_account\": \"elastic/fleet-server\",\n \"count\": 3,\n \"tokens\": {\n \"token1\": {}, \n \"token42\": {} \n },\n \"nodes_credentials\": { \n \"_nodes\": { \n \"total\": 3,\n \"successful\": 3,\n \"failed\": 0\n },\n \"file_tokens\": { \n \"my-token\": {\n \"nodes\": [ \"node0\", \"node1\" ] \n }\n }\n }\n}" x-state: Generally available; Added in 7.13.0 x-metaTags: - content: Elasticsearch name: product_name /_security/settings: get: tags: - security summary: Get security index settings description: 'Get the user-configurable settings for the security internal index (`.security` and associated indices). Only a subset of the index settings — those that are user-configurable—will be shown. This includes: * `index.auto_expand_replicas` * `index.number_of_replicas` ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-settings parameters: - in: query name: master_timeout description: 'Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.' deprecated: false schema: default: 30s allOf: - $ref: '#/components/schemas/_types.Duration' style: form responses: '200': description: '' content: application/json: schema: type: object properties: security: description: Settings for the index used for most security configuration, including native realm users and roles configured with the API. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' security-profile: description: Settings for the index used to store profile information. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' security-tokens: description: Settings for the index used to store tokens. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' required: - security - security-profile - security-tokens x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name put: tags: - security summary: Update security index settings description: 'Update the user-configurable settings for the security internal index (`.security` and associated indices). Only a subset of settings are allowed to be modified. This includes `index.auto_expand_replicas` and `index.number_of_replicas`. NOTE: If `index.auto_expand_replicas` is set, `index.number_of_replicas` will be ignored during updates. If a specific index is not in use on the system and settings are provided for it, the request will be rejected. This API does not yet support configuring the settings for indices before they are in use. ## Required authorization * Cluster privileges: `manage_security` ' operationId: security-update-settings parameters: - in: query name: master_timeout description: 'The period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.' deprecated: false schema: default: 30s allOf: - $ref: '#/components/schemas/_types.Duration' style: form - in: query name: timeout description: 'The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: security: description: Settings for the index used for most security configuration, including native realm users and roles configured with the API. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' security-profile: description: Settings for the index used to store profile information. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' security-tokens: description: Settings for the index used to store tokens. allOf: - $ref: '#/components/schemas/security._types.SecuritySettings' examples: SecurityUpdateSettingsRequestExample1: description: Run `PUT /_security/settings` to modify the security settings. value: "{\n \"security\": {\n \"index\": {\n \"auto_expand_replicas\": \"0-all\"\n }\n },\n \"security-tokens\": {\n \"index\": {\n \"auto_expand_replicas\": \"0-all\"\n } \n },\n \"security-profile\": {\n \"index\": {\n \"auto_expand_replicas\": \"0-all\"\n } \n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: acknowledged: type: boolean required: - acknowledged x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/stats: get: tags: - security summary: Get security stats description: 'Gather security usage statistics from all node(s) within the cluster. ## Required authorization * Cluster privileges: `monitor` ' operationId: security-get-stats responses: '200': description: '' content: application/json: schema: type: object properties: nodes: description: A map of node IDs to security statistics for that node. type: object additionalProperties: $ref: '#/components/schemas/security._types.NodeSecurityStats' required: - nodes examples: SecurityStatsExample1: description: A successful response from `GET /_security/stats`. value: "{\n \"nodes\": {\n \"CLeCBfYETO2mQ1R2Il5-SA\": {\n \"roles\": {\n \"dls\": {\n \"bit_set_cache\": {\n \"count\": 1,\n \"memory\": \"16b\",\n \"memory_in_bytes\": 16,\n \"hits\": 212,\n \"misses\": 1,\n \"evictions\": 0,\n \"hits_time_in_millis\": 5,\n \"misses_time_in_millis\": 0\n }\n }\n }\n }\n }\n}" x-state: Generally available; Added in 9.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/oauth2/token: post: tags: - security summary: Get a token description: 'Create a bearer token for access without requiring basic authentication. The tokens are created by the Elasticsearch Token Service, which is automatically enabled when you configure TLS on the HTTP interface. Alternatively, you can explicitly enable the `xpack.security.authc.token.enabled` setting. When you are running in production mode, a bootstrap check prevents you from enabling the token service unless you also enable TLS on the HTTP interface. The get token API takes the same parameters as a typical OAuth 2.0 token API except for the use of a JSON request body. A successful get token API call returns a JSON structure that contains the access token, the amount of time (seconds) that the token expires in, the type, and the scope if available. The tokens returned by the get token API have a finite period of time for which they are valid and after that time period, they can no longer be used. That time period is defined by the `xpack.security.authc.token.timeout` setting. If you want to invalidate a token immediately, you can do so by using the invalidate token API. ## Required authorization * Cluster privileges: `manage_token` ' externalDocs: description: More about setting up https url: https://www.elastic.co/docs/deploy-manage/security/set-up-basic-security-plus-https#encrypt-http-communication x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-get-token.html operationId: security-get-token requestBody: content: application/json: schema: type: object properties: grant_type: description: 'The type of grant. Supported grant types are: `password`, `_kerberos`, `client_credentials`, and `refresh_token`.' allOf: - $ref: '#/components/schemas/security.get_token.AccessTokenGrantType' scope: description: 'The scope of the token. Currently tokens are only issued for a scope of FULL regardless of the value sent with the request.' type: string password: description: 'The user''s password. If you specify the `password` grant type, this parameter is required. This parameter is not valid with any other supported grant type.' allOf: - $ref: '#/components/schemas/_types.Password' kerberos_ticket: description: 'The base64 encoded kerberos ticket. If you specify the `_kerberos` grant type, this parameter is required. This parameter is not valid with any other supported grant type.' type: string refresh_token: description: 'The string that was returned when you created the token, which enables you to extend its life. If you specify the `refresh_token` grant type, this parameter is required. This parameter is not valid with any other supported grant type.' type: string username: description: 'The username that identifies the user. If you specify the `password` grant type, this parameter is required. This parameter is not valid with any other supported grant type.' allOf: - $ref: '#/components/schemas/_types.Username' examples: GetUserAccessTokenRequestExample1: summary: A client_credentials grant type example description: 'Run `POST /_security/oauth2/token` to obtain a token using the `client_credentials` grant type, which simply creates a token as the authenticated user. ' value: "{\n \"grant_type\" : \"client_credentials\"\n}" GetUserAccessTokenRequestExample2: summary: A password grant type example description: 'Run `POST /_security/oauth2/token` to obtain a token for the `test_admin` user using the password grant type. This request needs to be made by an authenticated user with sufficient privileges that may or may not be the same as the one whose username is passed in the `username` parameter. ' value: "{\n \"grant_type\" : \"password\",\n \"username\" : \"test_admin\",\n \"password\" : \"x-pack-test-password\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: access_token: type: string expires_in: type: number scope: type: string type: type: string refresh_token: type: string kerberos_authentication_response_token: type: string authentication: allOf: - $ref: '#/components/schemas/security.get_token.AuthenticatedUser' required: - access_token - expires_in - type - authentication examples: GetUserAccessTokenResponseExample1: summary: A client_credentials grant type example description: A successful response from `POST /_security/oauth2/token`. value: "{\n \"access_token\" : \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\",\n \"type\" : \"Bearer\",\n \"expires_in\" : 1200,\n \"authentication\" : {\n \"username\" : \"test_admin\",\n \"roles\" : [\n \"superuser\"\n ],\n \"full_name\" : null,\n \"email\" : null,\n \"metadata\" : { },\n \"enabled\" : true,\n \"authentication_realm\" : {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"lookup_realm\" : {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"authentication_type\" : \"realm\"\n }\n}" GetUserAccessTokenResponseExample2: summary: A password grant type example description: A successful response from `POST /_security/oauth2/token`. value: "{\n \"access_token\" : \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\",\n \"type\" : \"Bearer\",\n \"expires_in\" : 1200,\n \"authentication\" : {\n \"username\" : \"test_admin\",\n \"roles\" : [\n \"superuser\"\n ],\n \"full_name\" : null,\n \"email\" : null,\n \"metadata\" : { },\n \"enabled\" : true,\n \"authentication_realm\" : {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"lookup_realm\" : {\n \"name\" : \"file\",\n \"type\" : \"file\"\n },\n \"authentication_type\" : \"realm\"\n }\n}" x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name delete: tags: - security summary: Invalidate a token description: 'The access tokens returned by the get token API have a finite period of time for which they are valid. After that time period, they can no longer be used. The time period is defined by the `xpack.security.authc.token.timeout` setting. The refresh tokens returned by the get token API are only valid for 24 hours. They can also be used exactly once. If you want to invalidate one or more access or refresh tokens immediately, use this invalidate token API. NOTE: While all parameters are optional, at least one of them is required. More specifically, either one of `token` or `refresh_token` parameters is required. If none of these two are specified, then `realm_name` and/or `username` need to be specified.' operationId: security-invalidate-token requestBody: content: application/json: schema: type: object properties: token: description: 'An access token. This parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.' type: string refresh_token: description: 'A refresh token. This parameter cannot be used if any of `refresh_token`, `realm_name`, or `username` are used.' type: string realm_name: description: 'The name of an authentication realm. This parameter cannot be used with either `refresh_token` or `token`.' allOf: - $ref: '#/components/schemas/_types.Name' username: description: 'The username of a user. This parameter cannot be used with either `refresh_token` or `token`.' allOf: - $ref: '#/components/schemas/_types.Username' examples: SecurityInvalidateTokenRequestExample1: summary: Invalidate an access token description: 'Run `DELETE /_security/oauth2/token` to invalidate an access token. ' value: "{\n \"token\" : \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\"\n}" SecurityInvalidateTokenRequestExample2: summary: Invalidate a refresh token description: 'Run `DELETE /_security/oauth2/token` to invalidate a refresh token. ' value: "{\n \"refresh_token\" : \"vLBPvmAB6KvwvJZr27cS\"\n}" SecurityInvalidateTokenRequestExample3: summary: Invalidate tokens by realm description: Run `DELETE /_security/oauth2/token` to invalidate all access tokens and refresh tokens for the `saml1` realm. value: "{\n \"realm_name\" : \"saml1\"\n}" SecurityInvalidateTokenRequestExample4: summary: Invalidate tokens by user description: Run `DELETE /_security/oauth2/token` to invalidate all access tokens and refresh tokens for the user `myuser` in all realms. value: "{\n \"username\" : \"myuser\"\n}" SecurityInvalidateTokenRequestExample5: summary: Invalidate tokens by user and realm description: Run `DELETE /_security/oauth2/token` to invalidate all access tokens and refresh tokens for the user `myuser` in the `saml1` realm. value: "{\n \"username\" : \"myuser\",\n \"realm_name\" : \"saml1\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: error_count: description: The number of errors that were encountered when invalidating the tokens. type: number error_details: description: 'Details about the errors. This field is not present in the response when `error_count` is `0`.' type: array items: $ref: '#/components/schemas/_types.ErrorCause' invalidated_tokens: description: The number of the tokens that were invalidated as part of this request. type: number previously_invalidated_tokens: description: The number of tokens that were already invalidated. type: number required: - error_count - invalidated_tokens - previously_invalidated_tokens examples: SecurityInvalidateTokenResponseExample1: description: 'A partially successful response from `DELETE /_security/oauth2/token`. The response includes the number of the tokens that were invalidated, the number of errors that were encountered when invalidating the tokens, and details about these errors. ' value: "{\n \"invalidated_tokens\":9, \n \"previously_invalidated_tokens\":15, \n \"error_count\":2, \n \"error_details\":[ \n {\n \"type\":\"exception\",\n \"reason\":\"Elasticsearch exception [type=exception, reason=foo]\",\n \"caused_by\":{\n \"type\":\"exception\",\n \"reason\":\"Elasticsearch exception [type=illegal_argument_exception, reason=bar]\"\n }\n },\n {\n \"type\":\"exception\",\n \"reason\":\"Elasticsearch exception [type=exception, reason=boo]\",\n \"caused_by\":{\n \"type\":\"exception\",\n \"reason\":\"Elasticsearch exception [type=illegal_argument_exception, reason=far]\"\n }\n }\n ]\n}" x-state: Generally available; Added in 5.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user: get: tags: - security summary: Get users description: 'Get information about users in the native realm and built-in users. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-user-1 parameters: - $ref: '#/components/parameters/security.get_user-with_profile_uid' responses: '200': $ref: '#/components/responses/security.get_user-200' x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/user/_privileges: get: tags: - security summary: Get user privileges description: 'Get the security privileges for the logged in user. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature. To check whether a user has a specific list of privileges, use the has privileges API.' operationId: security-get-user-privileges responses: '200': description: '' content: application/json: schema: type: object properties: applications: type: array items: $ref: '#/components/schemas/security._types.ApplicationPrivileges' cluster: type: array items: type: string remote_cluster: type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivileges' global: type: array items: $ref: '#/components/schemas/security._types.GlobalPrivilege' indices: type: array items: $ref: '#/components/schemas/security._types.UserIndicesPrivileges' remote_indices: type: array items: $ref: '#/components/schemas/security._types.RemoteUserIndicesPrivileges' run_as: type: array items: type: string required: - applications - cluster - global - indices - run_as examples: SecurityGetUserPrivilegesResponseExample1: description: A successful response from `GET /_security/user/_privileges`. value: "{\n \"cluster\" : [\n \"all\"\n ],\n \"global\" : [ ],\n \"indices\" : [\n {\n \"names\" : [\n \"*\"\n ],\n \"privileges\" : [\n \"all\"\n ],\n \"allow_restricted_indices\" : true\n }\n ],\n \"applications\" : [\n {\n \"application\" : \"*\",\n \"privileges\" : [\n \"*\"\n ],\n \"resources\" : [\n \"*\"\n ]\n }\n ],\n \"run_as\" : [\n \"*\"\n ]\n}" x-state: Generally available; Added in 6.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/profile/{uid}: get: tags: - security summary: Get a user profile description: 'Get a user''s profile using the unique profile ID. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-get-user-profile parameters: - in: path name: uid description: A unique identifier for the user profile. required: true deprecated: false schema: oneOf: - $ref: '#/components/schemas/security._types.UserProfileId' - type: array items: $ref: '#/components/schemas/security._types.UserProfileId' style: simple - in: query name: data description: 'A comma-separated list of filters for the `data` field of the profile document. To return all content use `data=*`. To return a subset of content use `data=` to retrieve content nested under the specified ``. By default returns no `data` content.' deprecated: false schema: oneOf: - type: string - type: array items: type: string style: form responses: '200': description: '' content: application/json: schema: type: object properties: profiles: description: 'A successful call returns the JSON representation of the user profile and its internal versioning numbers. The API returns an empty object if no profile document is found for the provided `uid`. The content of the data field is not returned by default to avoid deserializing a potential large payload.' type: array items: $ref: '#/components/schemas/security._types.UserProfileWithMetadata' errors: allOf: - $ref: '#/components/schemas/security.get_user_profile.GetUserProfileErrors' required: - profiles examples: GetUserProfileResponseExample1: summary: Profile details for a UUID description: 'A successful response from `GET /_security/profile/u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0`. By default, no content is returned in the `data` field. ' value: "{\n \"profiles\": [\n {\n \"uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\",\n \"enabled\": true,\n \"last_synchronized\": 1642650651037,\n \"user\": {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\", \"other_role1\"\n ],\n \"realm_name\": \"native\",\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\"\n },\n \"labels\": {\n \"direction\": \"north\"\n },\n \"data\": {}, \n \"_doc\": {\n \"_primary_term\": 88,\n \"_seq_no\": 66\n }\n }\n ]\n}" GetUserProfileResponseExample2: summary: Profile details for a UUID and data key description: 'A successful response from `GET /_security/profile/u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0?data=app1.key1`. ' value: "{\n \"profiles\": [\n {\n \"uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\",\n \"enabled\": true,\n \"last_synchronized\": 1642650651037,\n \"user\": {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\", \"other_role1\"\n ],\n \"realm_name\": \"native\",\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\"\n },\n \"labels\": {\n \"direction\": \"north\"\n },\n \"data\": {\n \"app1\": {\n \"key1\": \"value1\"\n }\n },\n \"_doc\": {\n \"_primary_term\": 88,\n \"_seq_no\": 66\n }\n }\n ]\n}" GetUserProfileResponseExample3: summary: Profile details with errors description: 'A response that contains errors that occurred while retrieving user profiles. ' value: "{\n \"profiles\": [],\n \"errors\": {\n \"count\": 1,\n \"details\": {\n \"u_FmxQt3gr1BBH5wpnz9HkouPj3Q710XkOgg1PWkwLPBW_5\": {\n \"type\": \"resource_not_found_exception\",\n \"reason\": \"profile document not found\"\n }\n }\n }\n}" x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/api_key/grant: post: tags: - security summary: Grant an API key description: 'Create an API key on behalf of another user. This API is similar to the create API keys API, however it creates the API key for a user that is different than the user that runs the API. The caller must have authentication credentials for the user on whose behalf the API key will be created. It is not possible to use this API to create an API key without that user''s credentials. The supported user authentication credential types are: * username and password * Elasticsearch access tokens * JWTs The user, for whom the authentication credentials is provided, can optionally "run as" (impersonate) another user. In this case, the API key will be created on behalf of the impersonated user. This API is intended be used by applications that need to create and manage API keys for end users, but cannot guarantee that those users have permission to create API keys on their own behalf. The API keys are created by the Elasticsearch API key service, which is automatically enabled. A successful grant API key API call returns a JSON structure that contains the API key, its unique id, and its name. If applicable, it also returns expiration information for the API key in milliseconds. By default, API keys never expire. You can specify expiration information when you create the API keys. ## Required authorization * Cluster privileges: `grant_api_key` ' operationId: security-grant-api-key parameters: - in: query name: refresh description: 'If ''true'', Elasticsearch refreshes the affected shards to make this operation visible to search. If ''wait_for'', it waits for a refresh to make this operation visible to search. If ''false'', nothing is done with refreshes.' deprecated: false schema: default: 'false' allOf: - $ref: '#/components/schemas/_types.Refresh' style: form requestBody: content: application/json: schema: type: object properties: api_key: description: The API key. allOf: - $ref: '#/components/schemas/security.grant_api_key.GrantApiKey' grant_type: description: 'The type of grant. Supported grant types are: `access_token`, `password`.' allOf: - $ref: '#/components/schemas/security.grant_api_key.ApiKeyGrantType' access_token: description: 'The user''s access token. If you specify the `access_token` grant type, this parameter is required. It is not valid with other grant types.' type: string username: description: 'The user name that identifies the user. If you specify the `password` grant type, this parameter is required. It is not valid with other grant types.' allOf: - $ref: '#/components/schemas/_types.Username' password: description: 'The user''s password. If you specify the `password` grant type, this parameter is required. It is not valid with other grant types.' allOf: - $ref: '#/components/schemas/_types.Password' run_as: description: The name of the user to be impersonated. allOf: - $ref: '#/components/schemas/_types.Username' required: - api_key - grant_type examples: SecurityGrantApiKeyRequestExample1: summary: Grant an API key description: 'Run `POST /_security/api_key/grant` to create an API key on behalf of the `test_admin` user. ' value: "{\n \"grant_type\": \"password\",\n \"username\" : \"test_admin\",\n \"password\" : \"x-pack-test-password\",\n \"api_key\" : {\n \"name\": \"my-api-key\",\n \"expiration\": \"1d\",\n \"role_descriptors\": {\n \"role-a\": {\n \"cluster\": [\"all\"],\n \"indices\": [\n {\n \"names\": [\"index-a*\"],\n \"privileges\": [\"read\"]\n }\n ]\n },\n \"role-b\": {\n \"cluster\": [\"all\"],\n \"indices\": [\n {\n \"names\": [\"index-b*\"],\n \"privileges\": [\"all\"]\n }\n ]\n }\n },\n \"metadata\": {\n \"application\": \"my-application\",\n \"environment\": {\n \"level\": 1,\n \"trusted\": true,\n \"tags\": [\"dev\", \"staging\"]\n }\n }\n }\n}" SecurityGrantApiKeyRequestExample2: summary: Grant an API key with run_as description: 'Run `POST /_security/api_key/grant`. The user (`test_admin`) whose credentials are provided can "run as" another user (`test_user`). The API key will be granted to the impersonated user (`test_user`). ' value: "{\n \"grant_type\": \"password\",\n \"username\" : \"test_admin\", \n \"password\" : \"x-pack-test-password\", \n \"run_as\": \"test_user\", \n \"api_key\" : {\n \"name\": \"another-api-key\"\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: api_key: type: string id: allOf: - $ref: '#/components/schemas/_types.Id' name: allOf: - $ref: '#/components/schemas/_types.Name' expiration: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' encoded: type: string required: - api_key - id - name - encoded x-state: Generally available; Added in 7.9.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user/_has_privileges: get: tags: - security summary: Check user privileges description: 'Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges.html operationId: security-has-privileges requestBody: $ref: '#/components/requestBodies/security.has_privileges' responses: '200': $ref: '#/components/responses/security.has_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Check user privileges description: 'Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges.html operationId: security-has-privileges-1 requestBody: $ref: '#/components/requestBodies/security.has_privileges' responses: '200': $ref: '#/components/responses/security.has_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/user/{user}/_has_privileges: get: tags: - security summary: Check user privileges description: 'Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges.html operationId: security-has-privileges-2 parameters: - $ref: '#/components/parameters/security.has_privileges-user' requestBody: $ref: '#/components/requestBodies/security.has_privileges' responses: '200': $ref: '#/components/responses/security.has_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Check user privileges description: 'Determine whether the specified user has a specified list of privileges. All users can use this API, but only to determine their own privileges. To check the privileges of other users, you must use the run as feature.' externalDocs: description: About Elasticsearch privileges url: https://www.elastic.co/docs/reference/elasticsearch/security-privileges x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges.html operationId: security-has-privileges-3 parameters: - $ref: '#/components/parameters/security.has_privileges-user' requestBody: $ref: '#/components/requestBodies/security.has_privileges' responses: '200': $ref: '#/components/responses/security.has_privileges-200' x-state: Generally available; Added in 6.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/profile/_has_privileges: get: tags: - security summary: Check user profile privileges description: 'Determine whether the users associated with the specified user profile IDs have all the requested privileges. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: Learn more about user profiles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/user-profiles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges-user-profile.html operationId: security-has-privileges-user-profile requestBody: $ref: '#/components/requestBodies/security.has_privileges_user_profile' responses: '200': $ref: '#/components/responses/security.has_privileges_user_profile-200' x-state: Generally available; Added in 8.3.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Check user profile privileges description: 'Determine whether the users associated with the specified user profile IDs have all the requested privileges. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` ' externalDocs: description: Learn more about user profiles url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/user-profiles x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-has-privileges-user-profile.html operationId: security-has-privileges-user-profile-1 requestBody: $ref: '#/components/requestBodies/security.has_privileges_user_profile' responses: '200': $ref: '#/components/responses/security.has_privileges_user_profile-200' x-state: Generally available; Added in 8.3.0 x-metaTags: - content: Elasticsearch name: product_name /_security/oidc/authenticate: post: tags: - security summary: Authenticate OpenID Connect description: 'Exchange an OpenID Connect authentication response message for an Elasticsearch internal access token and refresh token that can be subsequently used for authentication. Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.' operationId: security-oidc-authenticate requestBody: content: application/json: schema: type: object properties: nonce: description: 'Associate a client session with an ID token and mitigate replay attacks. This value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.' type: string realm: description: 'The name of the OpenID Connect realm. This property is useful in cases where multiple realms are defined.' type: string redirect_uri: description: 'The URL to which the OpenID Connect Provider redirected the User Agent in response to an authentication request after a successful authentication. This URL must be provided as-is (URL encoded), taken from the body of the response or as the value of a location header in the response from the OpenID Connect Provider.' type: string state: description: 'Maintain state between the authentication request and the response. This value needs to be the same as the one that was provided to the `/_security/oidc/prepare` API or the one that was generated by Elasticsearch and included in the response to that call.' type: string required: - nonce - redirect_uri - state examples: OidcAuthenticateRequestExample1: description: 'Run `POST /_security/oidc/authenticate` to exchange the response that was returned from the OpenID Connect Provider after a successful authentication for an Elasticsearch access token and refresh token. This example is from an authentication that uses the authorization code grant flow. ' value: "{\n \"redirect_uri\" : \"https://oidc-kibana.elastic.co:5603/api/security/oidc/callback?code=jtI3Ntt8v3_XvcLzCFGq&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I\",\n \"state\" : \"4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I\",\n \"nonce\" : \"WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM\",\n \"realm\" : \"oidc1\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: access_token: description: The Elasticsearch access token. type: string expires_in: description: The duration (in seconds) of the tokens. type: number refresh_token: description: The Elasticsearch refresh token. type: string type: description: The type of token. type: string required: - access_token - expires_in - refresh_token - type examples: OidcAuthenticateResponseExample1: description: 'A successful response from `POST /_security/oidc/authenticate`. It contains the access and refresh tokens that were generated, the token duration (in seconds), and the type. ' value: "{\n \"access_token\" : \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\",\n \"type\" : \"Bearer\",\n \"expires_in\" : 1200,\n \"refresh_token\": \"vLBPvmAB6KvwvJZr27cS\"\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/oidc/logout: post: tags: - security summary: Logout of OpenID Connect description: 'Invalidate an access token and a refresh token that were generated as a response to the `/_security/oidc/authenticate` API. If the OpenID Connect authentication realm in Elasticsearch is accordingly configured, the response to this call will contain a URI pointing to the end session endpoint of the OpenID Connect Provider in order to perform single logout. Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.' operationId: security-oidc-logout requestBody: content: application/json: schema: type: object properties: token: description: The access token to be invalidated. type: string refresh_token: description: The refresh token to be invalidated. type: string required: - token examples: OidcLogoutRequestExample1: description: Run `POST /_security/oidc/logout` to perform the logout. value: "{\n \"token\" : \"dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==\",\n \"refresh_token\": \"vLBPvmAB6KvwvJZr27cS\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: redirect: description: A URI that points to the end session endpoint of the OpenID Connect Provider with all the parameters of the logout request as HTTP GET parameters. type: string required: - redirect examples: OidcLogoutResponseExample1: description: A successful response from `POST /_security/oidc/logout`, which contains the URI pointing to the End Session Endpoint of the OpenID Connect Provider with all the parameters of the Logout Request as HTTP GET parameters. value: "{\n \"redirect\" : \"https://op-provider.org/logout?id_token_hint=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c&post_logout_redirect_uri=http%3A%2F%2Foidc-kibana.elastic.co%2Floggedout&state=lGYK0EcSLjqH6pkT5EVZjC6eIW5YCGgywj2sxROO\"\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/oidc/prepare: post: tags: - security summary: Prepare OpenID connect authentication description: 'Create an oAuth 2.0 authentication request as a URL string based on the configuration of the OpenID Connect authentication realm in Elasticsearch. The response of this API is a URL pointing to the Authorization Endpoint of the configured OpenID Connect Provider, which can be used to redirect the browser of the user in order to continue the authentication process. Elasticsearch exposes all the necessary OpenID Connect related functionality with the OpenID Connect APIs. These APIs are used internally by Kibana in order to provide OpenID Connect based authentication, but can also be used by other, custom web applications or other clients.' operationId: security-oidc-prepare-authentication requestBody: content: application/json: schema: type: object properties: iss: description: 'In the case of a third party initiated single sign on, this is the issuer identifier for the OP that the RP is to send the authentication request to. It cannot be specified when *realm* is specified. One of *realm* or *iss* is required.' type: string login_hint: description: 'In the case of a third party initiated single sign on, it is a string value that is included in the authentication request as the *login_hint* parameter. This parameter is not valid when *realm* is specified.' type: string nonce: description: 'The value used to associate a client session with an ID token and to mitigate replay attacks. If the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.' type: string realm: description: 'The name of the OpenID Connect realm in Elasticsearch the configuration of which should be used in order to generate the authentication request. It cannot be specified when *iss* is specified. One of *realm* or *iss* is required.' type: string state: description: 'The value used to maintain state between the authentication request and the response, typically used as a Cross-Site Request Forgery mitigation. If the caller of the API does not provide a value, Elasticsearch will generate one with sufficient entropy and return it in the response.' type: string examples: OidcPrepareAuthenticationRequestExample1: summary: Prepare with realm description: 'Run `POST /_security/oidc/prepare` to generate an authentication request for the OpenID Connect Realm `oidc1`. ' value: "{\n \"realm\" : \"oidc1\"\n}" OidcPrepareAuthenticationRequestExample2: summary: Prepare with realm, state, and nonce description: 'Run `POST /_security/oidc/prepare` to generate an authentication request for the OpenID Connect Realm `oidc1`, where the values for the `state` and the `nonce` have been generated by the client. ' value: "{\n \"realm\" : \"oidc1\",\n \"state\" : \"lGYK0EcSLjqH6pkT5EVZjC6eIW5YCGgywj2sxROO\",\n \"nonce\" : \"zOBXLJGUooRrbLbQk5YCcyC8AXw3iloynvluYhZ5\"\n}" OidcPrepareAuthenticationRequestExample3: summary: Prepare by realm description: 'Run `POST /_security/oidc/prepare` to generate an authentication request for a third party initiated single sign on. Specify the issuer that should be used for matching the appropriate OpenID Connect Authentication realm. ' value: "{\n \"iss\" : \"http://127.0.0.1:8080\",\n \"login_hint\": \"this_is_an_opaque_string\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: nonce: type: string realm: type: string redirect: description: A URI that points to the authorization endpoint of the OpenID Connect Provider with all the parameters of the authentication request as HTTP GET parameters. type: string state: type: string required: - nonce - realm - redirect - state examples: OidcPrepareAuthenticationResponseExample1: description: 'A successful response from `POST /_security/oidc/prepare`. It contains the URI pointing to the Authorization Endpoint of the OpenID Connect Provider with all the parameters of the Authentication Request as HTTP GET parameters. ' value: "{\n \"redirect\" : \"http://127.0.0.1:8080/c2id-login?scope=openid&response_type=id_token&redirect_uri=https%3A%2F%2Fmy.fantastic.rp%2Fcb&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I&nonce=WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM&client_id=elasticsearch-rp\",\n \"state\" : \"4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I\",\n \"nonce\" : \"WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM\",\n \"realm\" : \"oidc1\"\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/_query/api_key: get: tags: - security summary: Find API keys with a query description: 'Get a paginated list of API keys and their information. You can optionally filter the results with a query. To use this API, you must have at least the `manage_own_api_key` or the `read_security` cluster privileges. If you have only the `manage_own_api_key` privilege, this API returns only the API keys that you own. If you have the `read_security`, `manage_api_key`, or greater privileges (including `manage_security`), this API returns all API keys regardless of ownership. Refer to the linked documentation for examples of how to find API keys: ## Required authorization * Cluster privileges: `manage_own_api_key`,`read_security` ' externalDocs: description: About query API key information url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/query-api-keys x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-query-api-key.html operationId: security-query-api-keys parameters: - $ref: '#/components/parameters/security.query_api_keys-with_limited_by' - $ref: '#/components/parameters/security.query_api_keys-with_profile_uid' - $ref: '#/components/parameters/security.query_api_keys-typed_keys' requestBody: $ref: '#/components/requestBodies/security.query_api_keys' responses: '200': $ref: '#/components/responses/security.query_api_keys-200' x-state: Generally available; Added in 7.15.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Find API keys with a query description: 'Get a paginated list of API keys and their information. You can optionally filter the results with a query. To use this API, you must have at least the `manage_own_api_key` or the `read_security` cluster privileges. If you have only the `manage_own_api_key` privilege, this API returns only the API keys that you own. If you have the `read_security`, `manage_api_key`, or greater privileges (including `manage_security`), this API returns all API keys regardless of ownership. Refer to the linked documentation for examples of how to find API keys: ## Required authorization * Cluster privileges: `manage_own_api_key`,`read_security` ' externalDocs: description: About query API key information url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/query-api-keys x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-query-api-key.html operationId: security-query-api-keys-1 parameters: - $ref: '#/components/parameters/security.query_api_keys-with_limited_by' - $ref: '#/components/parameters/security.query_api_keys-with_profile_uid' - $ref: '#/components/parameters/security.query_api_keys-typed_keys' requestBody: $ref: '#/components/requestBodies/security.query_api_keys' responses: '200': $ref: '#/components/responses/security.query_api_keys-200' x-state: Generally available; Added in 7.15.0 x-metaTags: - content: Elasticsearch name: product_name /_security/_query/role: get: tags: - security summary: Find roles with a query description: 'Get roles in a paginated manner. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The query roles API does not retrieve roles that are defined in roles files, nor built-in ones. You can optionally filter the results with a query. Also, the results can be paginated and sorted. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-query-role requestBody: $ref: '#/components/requestBodies/security.query_role' responses: '200': $ref: '#/components/responses/security.query_role-200' x-state: Generally available; Added in 8.15.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Find roles with a query description: 'Get roles in a paginated manner. The role management APIs are generally the preferred way to manage roles, rather than using file-based role management. The query roles API does not retrieve roles that are defined in roles files, nor built-in ones. You can optionally filter the results with a query. Also, the results can be paginated and sorted. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-query-role-1 requestBody: $ref: '#/components/requestBodies/security.query_role' responses: '200': $ref: '#/components/responses/security.query_role-200' x-state: Generally available; Added in 8.15.0 x-metaTags: - content: Elasticsearch name: product_name /_security/_query/user: get: tags: - security summary: Find users with a query description: 'Get information for users in a paginated manner. You can optionally filter the results with a query. NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-query-user parameters: - $ref: '#/components/parameters/security.query_user-with_profile_uid' requestBody: $ref: '#/components/requestBodies/security.query_user' responses: '200': $ref: '#/components/responses/security.query_user-200' x-state: Generally available; Added in 8.14.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Find users with a query description: 'Get information for users in a paginated manner. You can optionally filter the results with a query. NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-query-user-1 parameters: - $ref: '#/components/parameters/security.query_user-with_profile_uid' requestBody: $ref: '#/components/requestBodies/security.query_user' responses: '200': $ref: '#/components/responses/security.query_user-200' x-state: Generally available; Added in 8.14.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/authenticate: post: tags: - security summary: Authenticate SAML description: 'Submit a SAML response message to Elasticsearch for consumption. NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack. The SAML message that is submitted can be: * A response to a SAML authentication request that was previously created using the SAML prepare authentication API. * An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow. In either case, the SAML message needs to be a base64 encoded XML document with a root element of ``. After successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication. This API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.' externalDocs: description: More about SAML authentication url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-saml-authenticate.html operationId: security-saml-authenticate requestBody: content: application/json: schema: type: object properties: content: description: The SAML response as it was sent by the user's browser, usually a Base64 encoded XML document. type: string ids: description: A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user. allOf: - $ref: '#/components/schemas/_types.Ids' realm: description: The name of the realm that should authenticate the SAML response. Useful in cases where many SAML realms are defined. type: string required: - content - ids examples: SamlAuthenticateRequestExample1: description: 'Run `POST /_security/saml/authenticate` to exchange a SAML Response indicating a successful authentication at the SAML IdP for an Elasticsearch access token and refresh token to be used in subsequent requests. ' value: "{\n \"content\" : \"PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMD.....\",\n \"ids\" : [\"4fee3b046395c4e751011e97f8900b5273d56685\"]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: access_token: description: The access token that was generated by Elasticsearch. type: string username: description: The authenticated user's name. type: string expires_in: description: The amount of time (in seconds) left until the token expires. type: number refresh_token: description: The refresh token that was generated by Elasticsearch. type: string realm: description: The name of the realm where the user was authenticated. type: string in_response_to: description: The id of the request that initiated the authentication process. type: string required: - access_token - username - expires_in - refresh_token - realm examples: SamlAuthenticateResponseExample1: description: A successful response from `POST /_security/saml/authenticate`. value: "{\n \"access_token\" : \"46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3\",\n \"username\" : \"Bearer\",\n \"expires_in\" : 1200,\n \"refresh_token\": \"mJdXLtmvTUSpoLwMvdBt_w\",\n \"realm\": \"saml1\",\n \"in_response_to\": \"4fee3b046395c4e751011e97f8900b5273d56685\"\n}" x-state: Generally available; Added in 7.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/complete_logout: post: tags: - security summary: Logout of SAML completely description: 'Verifies the logout response sent from the SAML IdP. NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack. The SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout. This API verifies the response by ensuring the content is relevant and validating its signature. An empty response is returned if the verification process is successful. The response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding. The caller of this API must prepare the request accordingly so that this API can handle either of them.' externalDocs: description: More about SAML authentication url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-saml-complete-logout.html operationId: security-saml-complete-logout requestBody: content: application/json: schema: type: object properties: realm: description: The name of the SAML realm in Elasticsearch for which the configuration is used to verify the logout response. type: string ids: description: A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user. allOf: - $ref: '#/components/schemas/_types.Ids' query_string: description: If the SAML IdP sends the logout response with the HTTP-Redirect binding, this field must be set to the query string of the redirect URI. type: string content: description: If the SAML IdP sends the logout response with the HTTP-Post binding, this field must be set to the value of the SAMLResponse form parameter from the logout response. type: string required: - realm - ids examples: SamlCompleteLogoutRequestExample1: summary: HTTP-Redirect binding description: 'Run `POST /_security/saml/complete_logout` to verify the logout response sent by the SAML IdP using the HTTP-Redirect binding. ' value: "{\n \"realm\": \"saml1\",\n \"ids\": [ \"_1c368075e0b3...\" ],\n \"query_string\": \"SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...\"\n}" SamlCompleteLogoutRequestExample2: summary: HTTP-Post binding description: 'Run `POST /_security/saml/complete_logout` to verify the logout response sent by the SAML IdP using the HTTP-Post binding. ' value: "{\n \"realm\": \"saml1\",\n \"ids\": [ \"_1c368075e0b3...\" ],\n \"content\": \"PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...\"\n}" required: true responses: '200': description: '' content: application/json: {} x-state: Generally available; Added in 7.14.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/invalidate: post: tags: - security summary: Invalidate SAML description: 'Submit a SAML LogoutRequest message to Elasticsearch for consumption. NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack. The logout request comes from the SAML IdP during an IdP initiated Single Logout. The custom web application can use this API to have Elasticsearch process the `LogoutRequest`. After successful validation of the request, Elasticsearch invalidates the access token and refresh token that corresponds to that specific SAML principal and provides a URL that contains a SAML LogoutResponse message. Thus the user can be redirected back to their IdP.' externalDocs: description: More about SAML authentication url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-saml-invalidate.html operationId: security-saml-invalidate requestBody: content: application/json: schema: type: object properties: acs: description: The Assertion Consumer Service URL that matches the one of the SAML realm in Elasticsearch that should be used. You must specify either this parameter or the `realm` parameter. type: string query_string: description: 'The query part of the URL that the user was redirected to by the SAML IdP to initiate the Single Logout. This query should include a single parameter named `SAMLRequest` that contains a SAML logout request that is deflated and Base64 encoded. If the SAML IdP has signed the logout request, the URL should include two extra parameters named `SigAlg` and `Signature` that contain the algorithm used for the signature and the signature value itself. In order for Elasticsearch to be able to verify the IdP''s signature, the value of the `query_string` field must be an exact match to the string provided by the browser. The client application must not attempt to parse or process the string in any way.' type: string realm: description: The name of the SAML realm in Elasticsearch the configuration. You must specify either this parameter or the `acs` parameter. type: string required: - query_string examples: SamlInvalidateRequestExample1: description: 'Run `POST /_security/saml/invalidate` to invalidate all the tokens for realm `saml1` pertaining to the user that is identified in the SAML Logout Request. ' value: "{\n \"query_string\" : \"SAMLRequest=nZFda4MwFIb%2FiuS%2BmviRpqFaClKQdbvo2g12M2KMraCJ9cRR9utnW4Wyi13sMie873MeznJ1aWrnS3VQGR0j4mLkKC1NUeljjA77zYyhVbIE0dR%2By7fmaHq7U%2BdegXWGpAZ%2B%2F4pR32luBFTAtWgUcCv56%2Fp5y30X87Yz1khTIycdgpUW9kY7WdsC9zxoXTvMvWuVV98YyMnSGH2SYE5pwALBIr9QKiwDGpW0oGVUznGeMyJZKFkQ4jBf5HnhUymjIhzCAL3KNFihbYx8TBYzzGaY7EnIyZwHzCWMfiDnbRIftkSjJr%2BFu0e9v%2B0EgOquRiiZjKpiVFp6j50T4WXoyNJ%2FEWC9fdqc1t%2F1%2B2F3aUpjzhPiXpqMz1%2FHSn4A&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=MsAYz2NFdovMG2mXf6TSpu5vlQQyEJAg%2B4KCwBqJTmrb3yGXKUtIgvjqf88eCAK32v3eN8vupjPC8LglYmke1ZnjK0%2FKxzkvSjTVA7mMQe2AQdKbkyC038zzRq%2FYHcjFDE%2Bz0qISwSHZY2NyLePmwU7SexEXnIz37jKC6NMEhus%3D\",\n \"realm\" : \"saml1\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: invalidated: description: The number of tokens that were invalidated as part of this logout. type: number realm: description: The realm name of the SAML realm in Elasticsearch that authenticated the user. type: string redirect: description: A SAML logout response as a parameter so that the user can be redirected back to the SAML IdP. type: string required: - invalidated - realm - redirect examples: SamlInvalidateResponseExample1: description: A successful response from `POST /_security/saml/invalidate`. value: "{\n \"redirect\" : \"https://my-idp.org/logout/SAMLResponse=....\",\n \"invalidated\" : 2,\n \"realm\" : \"saml1\"\n}" x-state: Generally available; Added in 7.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/logout: post: tags: - security summary: Logout of SAML description: 'Submits a request to invalidate an access token and refresh token. NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack. This API invalidates the tokens that were generated for a user by the SAML authenticate API. If the SAML realm in Elasticsearch is configured accordingly and the SAML IdP supports this, the Elasticsearch response contains a URL to redirect the user to the IdP that contains a SAML logout request (starting an SP-initiated SAML Single Logout).' externalDocs: description: More about SAML authentication url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-saml-logout.html operationId: security-saml-logout requestBody: content: application/json: schema: type: object properties: token: description: 'The access token that was returned as a response to calling the SAML authenticate API. Alternatively, the most recent token that was received after refreshing the original one by using a `refresh_token`.' type: string refresh_token: description: 'The refresh token that was returned as a response to calling the SAML authenticate API. Alternatively, the most recent refresh token that was received after refreshing the original access token.' type: string required: - token examples: SamlLogoutRequestExample1: description: 'Run `POST /_security/saml/logout` to invalidate the pair of tokens that were generated by calling the SAML authenticate API with a successful SAML response. ' value: "{\n \"token\" : \"46ToAxZVaXVVZTVKOVF5YU04ZFJVUDVSZlV3\",\n \"refresh_token\" : \"mJdXLtmvTUSpoLwMvdBt_w\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: redirect: description: 'A URL that contains a SAML logout request as a parameter. You can use this URL to be redirected back to the SAML IdP and to initiate Single Logout.' type: string required: - redirect examples: SamlLogoutResponseExample1: description: A successful response from `POST /_security/saml/logout`. value: "{\n \"redirect\" : \"https://my-idp.org/logout/SAMLRequest=....\"\n}" x-state: Generally available; Added in 7.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/prepare: post: tags: - security summary: Prepare SAML authentication description: 'Create a SAML authentication request (``) as a URL string based on the configuration of the respective SAML realm in Elasticsearch. NOTE: This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack. This API returns a URL pointing to the SAML Identity Provider. You can use the URL to redirect the browser of the user in order to continue the authentication process. The URL includes a single parameter named `SAMLRequest`, which contains a SAML Authentication request that is deflated and Base64 encoded. If the configuration dictates that SAML authentication requests should be signed, the URL has two extra parameters named `SigAlg` and `Signature`. These parameters contain the algorithm used for the signature and the signature value itself. It also returns a random string that uniquely identifies this SAML Authentication request. The caller of this API needs to store this identifier as it needs to be used in a following step of the authentication process.' externalDocs: description: More about SAML authentication url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/saml x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-saml-prepare-authentication.html operationId: security-saml-prepare-authentication requestBody: content: application/json: schema: type: object properties: acs: description: 'The Assertion Consumer Service URL that matches the one of the SAML realms in Elasticsearch. The realm is used to generate the authentication request. You must specify either this parameter or the `realm` parameter.' type: string realm: description: 'The name of the SAML realm in Elasticsearch for which the configuration is used to generate the authentication request. You must specify either this parameter or the `acs` parameter.' type: string relay_state: description: 'A string that will be included in the redirect URL that this API returns as the `RelayState` query parameter. If the Authentication Request is signed, this value is used as part of the signature computation.' type: string examples: SamlPrepareAuthenticationRequestExample1: summary: Prepare with a realm description: 'Run `POST /_security/saml/prepare` to generate a SAML authentication request for the SAML realm named `saml1`. ' value: "{\n \"realm\" : \"saml1\"\n}" SamlPrepareAuthenticationRequestExample2: summary: Prepare with an ACS description: 'Run `POST /_security/saml/prepare` to generate a SAML authentication request for the SAML realm with an Assertion Consuming Service (ACS) URL. ' value: "{\n \"acs\" : \"https://kibana.org/api/security/saml/callback\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: id: description: A unique identifier for the SAML Request to be stored by the caller of the API. allOf: - $ref: '#/components/schemas/_types.Id' realm: description: The name of the Elasticsearch realm that was used to construct the authentication request. type: string redirect: description: The URL to redirect the user to. type: string required: - id - realm - redirect examples: SAmlPrepareAuthenticationResponseExample1: description: A successful response from `POST /_security/saml/prepare`. value: "{\n \"redirect\": \"https://my-idp.org/login?SAMLRequest=fVJdc6IwFP0rmbwDgUKLGbFDtc462%2B06FX3Yl50rBJsKCZsbrPbXL6J22hdfk%2FNx7zl3eL%2BvK7ITBqVWCfVdRolQuS6k2iR0mU2dmN6Phgh1FTQ8be2rehH%2FWoGWdESF%2FPST0NYorgElcgW1QG5zvkh%2FPfHAZbwx2upcV5SkiMLYzmqsFba1MAthdjIXy5enhL5a23DPOyo6W7kGBa7cwhZ2gO7G8OiW%2BR400kORt0bag7fzezAlk24eqcD2OxxlsNN5O3MdsW9c6CZnbq7rntF4d3s0D7BaHTZhIWN52P%2BcjiuGRbDU6cdj%2BEjJbJLQv4N4ADdhxBiEZbQuWclY4Q8iABbCXczCdSiKMAC%2FgyO2YqbQgrIJDZg%2FcFjsMD%2Fzb3gUcBa5sR%2F9oWR%2BzuJBqlPG14Jbn0DIf2TZ3Jn%2FXmSUrC5ddQB6bob37uZrJdeF4dIDHV3iuhb70Ptq83kOz53ubDLXlcwPJK0q%2FT42AqxIaAkVCkqm2tRgr49yfJGFU%2FZQ3hy3QyuUpd7obPv97kb%2FAQ%3D%3D\"}\",\n \"realm\": \"saml1\",\n \"id\": \"_989a34500a4f5bf0f00d195aa04a7804b4ed42a1\"\n}" x-state: Generally available; Added in 7.5.0 x-metaTags: - content: Elasticsearch name: product_name /_security/saml/metadata/{realm_name}: get: tags: - security summary: Create SAML service provider metadata description: 'Generate SAML metadata for a SAML 2.0 Service Provider. The SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file. This API generates Service Provider metadata based on the configuration of a SAML realm in Elasticsearch.' operationId: security-saml-service-provider-metadata parameters: - in: path name: realm_name description: The name of the SAML realm in Elasticsearch. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: metadata: description: An XML string that contains a SAML Service Provider's metadata for the realm. type: string required: - metadata examples: SamlServiceProviderMetadataResponseExample1: description: 'A successful response from `POST /_security/profile/u_P_0BMHgaOK3p7k-PFWUCbw9dQ-UFjt01oWJ_Dp2PmPc_0/_data`, which indicates that the request is acknowledged. ' value: '{ "metadata": """""" }' x-state: Generally available; Added in 7.11.0 x-metaTags: - content: Elasticsearch name: product_name /_security/profile/_suggest: get: tags: - security summary: Suggest a user profile description: 'Get suggestions for user profiles that match specified search criteria. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-suggest-user-profiles parameters: - $ref: '#/components/parameters/security.suggest_user_profiles-data' requestBody: $ref: '#/components/requestBodies/security.suggest_user_profiles' responses: '200': $ref: '#/components/responses/security.suggest_user_profiles-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Suggest a user profile description: 'Get suggestions for user profiles that match specified search criteria. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. ## Required authorization * Cluster privileges: `read_security` ' operationId: security-suggest-user-profiles-1 parameters: - $ref: '#/components/parameters/security.suggest_user_profiles-data' requestBody: $ref: '#/components/requestBodies/security.suggest_user_profiles' responses: '200': $ref: '#/components/responses/security.suggest_user_profiles-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_security/api_key/{id}: put: tags: - security summary: Update an API key description: 'Update attributes of an existing API key. This API supports updates to an API key''s access scope, expiration, and metadata. To use this API, you must have at least the `manage_own_api_key` cluster privilege. Users can only update API keys that they created or that were granted to them. To update another user’s API key, use the `run_as` feature to submit a request on behalf of another user. IMPORTANT: It''s not possible to use an API key as the authentication credential for this API. The owner user’s credentials are required. Use this API to update API keys created by the create API key or grant API Key APIs. If you need to apply the same update to many API keys, you can use the bulk update API keys API to reduce overhead. It''s not possible to update expired API keys or API keys that have been invalidated by the invalidate API key API. The access scope of an API key is derived from the `role_descriptors` you specify in the request and a snapshot of the owner user''s permissions at the time of the request. The snapshot of the owner''s permissions is updated automatically on every call. IMPORTANT: If you don''t specify `role_descriptors` in the request, a call to this API might still change the API key''s access scope. This change can occur if the owner user''s permissions have changed since the API key was created or last modified. ## Required authorization * Cluster privileges: `manage_own_api_key` ' operationId: security-update-api-key parameters: - in: path name: id description: The ID of the API key to update. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: role_descriptors: description: 'The role descriptors to assign to this API key. The API key''s effective permissions are an intersection of its assigned privileges and the point in time snapshot of permissions of the owner user. You can assign new privileges by specifying them in this parameter. To remove assigned privileges, you can supply an empty `role_descriptors` parameter, that is to say, an empty object `{}`. If an API key has no assigned privileges, it inherits the owner user''s full permissions. The snapshot of the owner''s permissions is always updated, whether you supply the `role_descriptors` parameter or not. The structure of a role descriptor is the same as the request for the create API keys API.' type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' metadata: description: 'Arbitrary metadata that you want to associate with the API key. It supports a nested data structure. Within the metadata object, keys beginning with `_` are reserved for system usage. When specified, this value fully replaces the metadata previously associated with the API key.' allOf: - $ref: '#/components/schemas/_types.Metadata' expiration: description: 'The expiration time for the API key. By default, API keys never expire. This property can be omitted to leave the expiration unchanged.' allOf: - $ref: '#/components/schemas/_types.Duration' examples: UpdateApiKeyRequestExample1: summary: Update role and metadata description: 'Run `PUT /_security/api_key/VuaCfGcBCdbkQm-e5aOx` to assign new role descriptors and metadata to an API key. ' value: "{\n \"role_descriptors\": {\n \"role-a\": {\n \"indices\": [\n {\n \"names\": [\"*\"],\n \"privileges\": [\"write\"]\n }\n ]\n }\n },\n \"metadata\": {\n \"environment\": {\n \"level\": 2,\n \"trusted\": true,\n \"tags\": [\"production\"]\n }\n }\n}" UpdateApiKeyRequestExample2: summary: Remove permissions description: 'Run `PUT /_security/api_key/VuaCfGcBCdbkQm-e5aOx` to remove the API key''s previously assigned permissions. It will inherit the owner user''s full permissions. ' value: "{\n \"role_descriptors\": {}\n}" responses: '200': description: '' content: application/json: schema: type: object properties: updated: description: 'If `true`, the API key was updated. If `false`, the API key didn''t change because no change was detected.' type: boolean required: - updated examples: UpdateApiKeyResponseExample1: summary: Update role and metadata description: 'A successful response from `PUT /_security/api_key/VuaCfGcBCdbkQm-e5aOx`. The API key''s effective permissions after the update will be the intersection of the supplied role descriptors and the owner user''s permissions. ' value: "{\n \"updated\": true\n}" x-state: Generally available; Added in 8.4.0 x-metaTags: - content: Elasticsearch name: product_name /_security/cross_cluster/api_key/{id}: put: tags: - security summary: Update a cross-cluster API key description: 'Update the attributes of an existing cross-cluster API key, which is used for API key based remote cluster access. To use this API, you must have at least the `manage_security` cluster privilege. Users can only update API keys that they created. To update another user''s API key, use the `run_as` feature to submit a request on behalf of another user. IMPORTANT: It''s not possible to use an API key as the authentication credential for this API. To update an API key, the owner user''s credentials are required. It''s not possible to update expired API keys, or API keys that have been invalidated by the invalidate API key API. This API supports updates to an API key''s access scope, metadata, and expiration. The owner user''s information, such as the `username` and `realm`, is also updated automatically on every call. NOTE: This API cannot update REST API keys, which should be updated by either the update API key or bulk update API keys API. To learn more about how to use this API, refer to the [Update cross cluter API key API examples page](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/update-cc-api-key-examples). ## Required authorization * Cluster privileges: `manage_security` ' externalDocs: description: About adding remote clusters url: https://www.elastic.co/docs/deploy-manage/remote-clusters/remote-clusters-api-key x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-update-cross-cluster-api-key.html operationId: security-update-cross-cluster-api-key parameters: - in: path name: id description: The ID of the cross-cluster API key to update. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: access: description: 'The access to be granted to this API key. The access is composed of permissions for cross cluster search and cross cluster replication. At least one of them must be specified. When specified, the new access assignment fully replaces the previously assigned access.' allOf: - $ref: '#/components/schemas/security._types.Access' expiration: description: 'The expiration time for the API key. By default, API keys never expire. This property can be omitted to leave the value unchanged.' allOf: - $ref: '#/components/schemas/_types.Duration' metadata: description: 'Arbitrary metadata that you want to associate with the API key. It supports nested data structure. Within the metadata object, keys beginning with `_` are reserved for system usage. When specified, this information fully replaces metadata previously associated with the API key.' allOf: - $ref: '#/components/schemas/_types.Metadata' certificate_identity: description: 'The certificate identity to associate with this API key. This field is used to restrict the API key to connections authenticated by a specific TLS certificate. The value should match the certificate''s distinguished name (DN) pattern. When specified, this fully replaces any previously assigned certificate identity. To clear an existing certificate identity, explicitly set this field to `null`. When omitted, the existing certificate identity remains unchanged.' type: string required: - access examples: UpdateCrossClusterApiKeyRequestExample1: description: 'Run `PUT /_security/cross_cluster/api_key/VuaCfGcBCdbkQm-e5aOx` to update a cross-cluster API key, assigning it new access scope and metadata. ' value: "{\n \"access\": {\n \"replication\": [\n {\n \"names\": [\"archive\"]\n }\n ]\n },\n \"metadata\": {\n \"application\": \"replication\"\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: updated: description: 'If `true`, the API key was updated. If `false`, the API key didn’t change because no change was detected.' type: boolean required: - updated examples: UpdateCrossClusterApiKeyResponseExample1: description: 'A successful response from `PUT /_security/cross_cluster/api_key/VuaCfGcBCdbkQm-e5aOx` that indicates that the API key was updated. ' value: "{\n \"updated\": true\n}" x-state: Generally available x-metaTags: - content: Elasticsearch name: product_name /_security/profile/{uid}/_data: put: tags: - security summary: Update user profile data description: 'Update specific data for the user profile that is associated with a unique ID. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. To use this API, you must have one of the following privileges: * The `manage_user_profile` cluster privilege. * The `update_profile_data` global privilege for the namespaces that are referenced in the request. This API updates the `labels` and `data` fields of an existing user profile document with JSON objects. New keys and their values are added to the profile document and conflicting keys are replaced by data that''s included in the request. For both labels and data, content is namespaced by the top-level fields. The `update_profile_data` global privilege grants privileges for updating only the allowed namespaces. ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-update-user-profile-data parameters: - $ref: '#/components/parameters/security.update_user_profile_data-uid' - $ref: '#/components/parameters/security.update_user_profile_data-if_seq_no' - $ref: '#/components/parameters/security.update_user_profile_data-if_primary_term' - $ref: '#/components/parameters/security.update_user_profile_data-refresh' requestBody: $ref: '#/components/requestBodies/security.update_user_profile_data' responses: '200': $ref: '#/components/responses/security.update_user_profile_data-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name post: tags: - security summary: Update user profile data description: 'Update specific data for the user profile that is associated with a unique ID. NOTE: The user profile feature is designed only for use by Kibana and Elastic''s Observability, Enterprise Search, and Elastic Security solutions. Individual users and external applications should not call this API directly. Elastic reserves the right to change or remove this feature in future releases without prior notice. To use this API, you must have one of the following privileges: * The `manage_user_profile` cluster privilege. * The `update_profile_data` global privilege for the namespaces that are referenced in the request. This API updates the `labels` and `data` fields of an existing user profile document with JSON objects. New keys and their values are added to the profile document and conflicting keys are replaced by data that''s included in the request. For both labels and data, content is namespaced by the top-level fields. The `update_profile_data` global privilege grants privileges for updating only the allowed namespaces. ## Required authorization * Cluster privileges: `manage_user_profile` ' operationId: security-update-user-profile-data-1 parameters: - $ref: '#/components/parameters/security.update_user_profile_data-uid' - $ref: '#/components/parameters/security.update_user_profile_data-if_seq_no' - $ref: '#/components/parameters/security.update_user_profile_data-if_primary_term' - $ref: '#/components/parameters/security.update_user_profile_data-refresh' requestBody: $ref: '#/components/requestBodies/security.update_user_profile_data' responses: '200': $ref: '#/components/responses/security.update_user_profile_data-200' x-state: Generally available; Added in 8.2.0 x-metaTags: - content: Elasticsearch name: product_name /_ssl/certificates: get: tags: - security summary: Get SSL certificates description: 'Get information about the X.509 certificates that are used to encrypt communications in the cluster. The API returns a list that includes certificates from all TLS contexts including: - Settings for transport and HTTP interfaces - TLS settings that are used within authentication realms - TLS settings for remote monitoring exporters The list includes certificates that are used for configuring trust, such as those configured in the `xpack.security.transport.ssl.truststore` and `xpack.security.transport.ssl.certificate_authorities` settings. It also includes certificates that are used for configuring server identity, such as `xpack.security.http.ssl.keystore` and `xpack.security.http.ssl.certificate settings`. The list does not include certificates that are sourced from the default SSL context of the Java Runtime Environment (JRE), even if those certificates are in use within Elasticsearch. NOTE: When a PKCS#11 token is configured as the truststore of the JRE, the API returns all the certificates that are included in the PKCS#11 token irrespective of whether these are used in the Elasticsearch TLS configuration. If Elasticsearch is configured to use a keystore or truststore, the API output includes all certificates in that store, even though some of the certificates might not be in active use within the cluster. ## Required authorization * Cluster privileges: `monitor` ' externalDocs: description: About setting up transport tls url: https://www.elastic.co/docs/deploy-manage/security/set-up-basic-security#encrypt-internode-communication x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-api-ssl.html operationId: ssl-certificates responses: '200': description: '' content: application/json: schema: type: array items: $ref: '#/components/schemas/ssl.certificates.CertificateInformation' examples: GetCertificatesResponseExample1: description: 'A successful response from `GET /_ssl/certificates`, which provides information about the certificates on a single node of Elasticsearch. ' value: "[\n {\n \"path\": \"certs/elastic-certificates.p12\",\n \"format\": \"PKCS12\",\n \"alias\": \"instance\",\n \"subject_dn\": \"CN=Elastic Certificate Tool Autogenerated CA\",\n \"serial_number\": \"a20f0ee901e8f69dc633ff633e5cd5437cdb4137\",\n \"has_private_key\": false,\n \"expiry\": \"2021-01-15T20:42:49.000Z\"\n },\n {\n \"path\": \"certs/elastic-certificates.p12\",\n \"format\": \"PKCS12\",\n \"alias\": \"ca\",\n \"subject_dn\": \"CN=Elastic Certificate Tool Autogenerated CA\",\n \"serial_number\": \"a20f0ee901e8f69dc633ff633e5cd5437cdb4137\",\n \"has_private_key\": false,\n \"expiry\": \"2021-01-15T20:42:49.000Z\"\n },\n {\n \"path\": \"certs/elastic-certificates.p12\",\n \"format\": \"PKCS12\",\n \"alias\": \"instance\",\n \"subject_dn\": \"CN=instance\",\n \"serial_number\": \"fc1905e1494dc5230218d079c47a617088f84ce0\",\n \"has_private_key\": true,\n \"expiry\": \"2021-01-15T20:44:32.000Z\"\n }\n]" x-state: Generally available; Added in 6.2.0 x-metaTags: - content: Elasticsearch name: product_name /api/security/role/_query: post: description: Query Kibana roles with optional filters, paging, and sorting. operationId: post-security-role-query parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: queryRolesRequest: value: from: 0 query: kibana size: 25 sort: direction: asc field: name schema: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_body' responses: '200': content: application/json: examples: queryRolesResponse: value: count: 1 roles: - _unrecognized_applications: [] description: My custom Kibana role. elasticsearch: cluster: - monitor indices: - names: - logs-* privileges: - read run_as: [] kibana: - base: - read feature: {} spaces: - default metadata: {} name: my_kibana_role transient_metadata: enabled: true total: 1 schema: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_response' description: Indicates a successful call. summary: Query roles tags: - security x-metaTags: - content: Kibana name: product_name security: - apiKeyAuth: [] - basicAuth: [] servers: - url: https://{kibana_url} variables: kibana_url: default: localhost:5601 components: schemas: _types.query_dsl.SpanContainingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: big: description: 'Can be any span query. Matching spans from `big` that contain matches from `little` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' little: description: 'Can be any span query. Matching spans from `big` that contain matches from `little` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - big - little _types.query_dsl.TypeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: type: string required: - value _types.analysis.MinHashTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - min_hash bucket_count: description: Number of buckets to which hashes are assigned. Defaults to `512`. type: number hash_count: description: Number of ways to hash each token in the stream. Defaults to `1`. type: number hash_set_size: description: 'Number of hashes to keep from each bucket. Defaults to `1`. Hashes are retained by ascending size, starting with the bucket’s smallest hash first.' type: number with_rotation: description: If `true`, the filter fills empty buckets with the value of the first non-empty bucket to its circular right if the `hash_set_size` is `1`. If the `bucket_count` argument is greater than 1, this parameter defaults to `true`. Otherwise, this parameter defaults to `false`. type: boolean required: - type _types.aggregations.TopHitsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: docvalue_fields: description: Fields for which to return doc values. type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' explain: description: If `true`, returns detailed information about score computation as part of a hit. default: false type: boolean fields: description: 'Array of wildcard (*) patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' from: description: Starting document offset. default: 0.0 type: number highlight: description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results. allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' script_fields: description: Returns the result of one or more script evaluations for each hit. type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' size: description: The maximum number of top matching hits to return per bucket. default: 3.0 type: number sort: description: 'Sort order of the top matching hits. By default, the hits are sorted by the score of the main query.' allOf: - $ref: '#/components/schemas/_types.Sort' _source: description: Selects the fields of the source that are returned. allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' stored_fields: description: Returns values for the specified stored fields (fields that use the `store` mapping option). allOf: - $ref: '#/components/schemas/_types.Fields' track_scores: description: If `true`, calculates and returns document scores, even if the scores are not used for sorting. default: false type: boolean version: description: If `true`, returns document version as part of a hit. default: false type: boolean seq_no_primary_term: description: If `true`, returns sequence number and primary term of the last modification of each hit. type: boolean _types.query_dsl.CombinedFieldsZeroTerms: type: string enum: - none - all _types.aggregations.BucketSelectorAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script to run for this aggregation. allOf: - $ref: '#/components/schemas/_types.Script' _types.analysis.HunspellTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - hunspell dedup: description: If `true`, duplicate tokens are removed from the filter’s output. Defaults to `true`. type: boolean dictionary: description: 'One or more `.dic` files (e.g, `en_US.dic`, my_custom.dic) to use for the Hunspell dictionary. By default, the `hunspell` filter uses all `.dic` files in the `<$ES_PATH_CONF>/hunspell/` directory specified using the `lang`, `language`, or `locale` parameter.' type: string locale: description: Locale directory used to specify the `.aff` and `.dic` files for a Hunspell dictionary. type: string longest_only: description: If `true`, only the longest stemmed version of each token is included in the output. If `false`, all stemmed versions of the token are included. Defaults to `false`. type: boolean required: - type - locale _types.aggregations.TermsPartition: type: object properties: num_partitions: description: The number of partitions. type: number partition: description: The partition number for this request. type: number required: - num_partitions - partition security.query_role.RoleQueryContainer: type: object properties: bool: description: matches roles matching boolean combinations of other queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoolQuery' exists: description: Returns roles that contain an indexed value for a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.ExistsQuery' ids: description: 'Returns roles based on their IDs. This query uses role document IDs stored in the `_id` field.' allOf: - $ref: '#/components/schemas/_types.query_dsl.IdsQuery' match: description: 'Returns roles that match a provided text, number, date or boolean value. The provided text is analyzed before matching.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchQuery' minProperties: 1 maxProperties: 1 match_all: description: Matches all roles, giving them all a `_score` of 1.0. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchAllQuery' prefix: description: Returns roles that contain a specific prefix in a provided field. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.PrefixQuery' minProperties: 1 maxProperties: 1 range: description: Returns roles that contain terms within a provided range. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RangeQuery' minProperties: 1 maxProperties: 1 simple_query_string: description: Returns roles based on a provided query string, using a parser with a limited but fault-tolerant syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringQuery' term: description: 'Returns roles that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field''s value, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermQuery' minProperties: 1 maxProperties: 1 terms: description: 'Returns roles that contain one or more exact terms in a provided field. To return a document, one or more terms must exactly match a field value, including whitespace and capitalization.' allOf: - $ref: '#/components/schemas/_types.query_dsl.TermsQuery' wildcard: description: Returns roles that contain terms matching a wildcard pattern. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WildcardQuery' minProperties: 1 maxProperties: 1 minProperties: 1 maxProperties: 1 _types.query_dsl.GeoBoundingBoxQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: type: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoExecution' validation_method: description: 'Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude. Set to `COERCE` to also try to infer correct latitude or longitude.' default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean _types.analysis.DanishAnalyzer: type: object properties: type: type: string enum: - danish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.SortResults: type: array items: $ref: '#/components/schemas/_types.FieldValue' indices._types.SoftDeletes: type: object properties: enabled: description: Indicates whether soft deletes are enabled on the index. default: true type: boolean retention_lease: description: 'The maximum period to retain a shard history retention lease before it is considered expired. Shard history retention leases ensure that soft deletes are retained during merges on the Lucene index. If a soft delete is merged away before it can be replicated to a follower the following process will fail due to incomplete history on the leader.' allOf: - $ref: '#/components/schemas/indices._types.RetentionLease' _types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator: type: object properties: doc_count: description: 'The total number of documents that initially created the expectations. It’s required to be greater than or equal to the sum of all values in the buckets_path as this is the originating superset of data to which the term values are correlated.' type: number expectations: description: 'An array of numbers with which to correlate the configured `bucket_path` values. The length of this value must always equal the number of buckets returned by the `bucket_path`.' type: array items: type: number fractions: description: 'An array of fractions to use when averaging and calculating variance. This should be used if the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided, must equal expectations.' type: array items: type: number required: - doc_count - expectations indices._types.SegmentSortMode: type: string enum: - min - MIN - max - MAX _types.analysis.KuromojiAnalyzer: type: object properties: type: type: string enum: - kuromoji mode: allOf: - $ref: '#/components/schemas/_types.analysis.KuromojiTokenizationMode' user_dictionary: type: string required: - type _types.aggregations.ChildrenAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: type: description: The child type that should be selected. allOf: - $ref: '#/components/schemas/_types.RelationName' _types.EpochTimeUnitMillis: allOf: - $ref: '#/components/schemas/_types.UnitMillis' _types.aggregations.MatrixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: fields: description: An array of fields for computing the statistics. allOf: - $ref: '#/components/schemas/_types.Fields' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: object additionalProperties: type: number _types.aggregations.MultiBucketAggregateBaseMultiTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsMultiTermsBucket' required: - buckets _types.aggregations.MultiBucketBase: description: Base type for multi-bucket aggregation results that can hold sub-aggregations results. type: object properties: doc_count: type: number required: - doc_count _types.aggregations.BucketsMultiTermsBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket' _types.query_dsl.DisMaxQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: queries: description: 'One or more query clauses. Returned documents must match one or more of these queries. If a document matches multiple queries, Elasticsearch uses the highest relevance score.' type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' tie_breaker: description: Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses. default: 0.0 type: number required: - queries _types.aggregations.SamplerAggregationExecutionHint: type: string enum: - map - global_ordinals - bytes_hash _types.aggregations.MovingPercentilesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: window: description: The size of window to "slide" across the histogram. type: number shift: description: 'By default, the window consists of the last n values excluding the current bucket. Increasing `shift` by 1, moves the starting window position by 1 to the right.' default: 0.0 type: number keyed: type: boolean _types.aggregations.HoltWintersModelSettings: type: object properties: alpha: type: number beta: type: number gamma: type: number pad: type: boolean period: type: number type: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltWintersType' _types.aggregations.HistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: extended_bounds: description: Enables extending the bounds of the histogram beyond the data itself. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble' hard_bounds: description: 'Limits the range of buckets in the histogram. It is particularly useful in the case of open data ranges that can result in a very large number of buckets.' allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble' field: description: The name of the field to aggregate on. allOf: - $ref: '#/components/schemas/_types.Field' interval: description: 'The interval for the buckets. Must be a positive decimal.' type: number min_doc_count: description: 'Only returns buckets that have `min_doc_count` number of documents. By default, the response will fill gaps in the histogram with empty buckets.' type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: number offset: description: 'By default, the bucket keys start with 0 and then continue in even spaced steps of `interval`. The bucket boundaries can be shifted by using the `offset` option.' type: number order: description: 'The sort order of the returned buckets. By default, the returned buckets are sorted by their key ascending.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' format: type: string keyed: description: If `true`, returns buckets as a hash instead of an array, keyed by the bucket keys. default: false type: boolean _types.GeoTilePrecision: type: number _types.analysis.CompoundWordTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: max_subword_size: description: Maximum subword character length. Longer subword tokens are excluded from the output. Defaults to `15`. type: number min_subword_size: description: Minimum subword character length. Shorter subword tokens are excluded from the output. Defaults to `2`. type: number min_word_size: description: Minimum word character length. Shorter word tokens are excluded from the output. Defaults to `5`. type: number only_longest_match: description: If `true`, only include the longest matching subword. Defaults to `false`. type: boolean word_list: description: 'A list of subwords to look for in the token stream. If found, the subword is included in the token output. Either this parameter or `word_list_path` must be specified.' type: array items: type: string word_list_path: description: 'Path to a file that contains a list of subwords to find in the token stream. If found, the subword is included in the token output. This path must be absolute or relative to the config location, and the file must be UTF-8 encoded. Each token in the file must be separated by a line break. Either this parameter or `word_list` must be specified.' type: string _types.aggregations.DateRangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are use to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' format: description: The date format used to format `from` and `to` in the response. type: string missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' ranges: description: Array of date ranges. type: array items: $ref: '#/components/schemas/_types.aggregations.DateRangeExpression' time_zone: description: Time zone used to convert dates from another time zone to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' keyed: description: Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array. type: boolean indices._types.MappingLimitSettingsFieldNameLength: type: object properties: limit: description: 'Setting for the maximum length of a field name. This setting isn’t really something that addresses mappings explosion but might still be useful if you want to limit the field length. It usually shouldn’t be necessary to set this setting. The default is okay unless a user starts to add a huge number of fields with really long names. Default is `Long.MAX_VALUE` (no limit).' type: number indices._types.SettingsSimilarityDfr: type: object properties: type: type: string enum: - DFR after_effect: allOf: - $ref: '#/components/schemas/_types.DFRAfterEffect' basic_model: allOf: - $ref: '#/components/schemas/_types.DFRBasicModel' normalization: allOf: - $ref: '#/components/schemas/_types.Normalization' required: - type - after_effect - basic_model - normalization indices._types.TranslogRetention: type: object properties: size: description: 'This controls the total size of translog files to keep for each shard. Keeping more translog files increases the chance of performing an operation based sync when recovering a replica. If the translog files are not sufficient, replica recovery will fall back to a file based sync. This setting is ignored, and should not be set, if soft deletes are enabled. Soft deletes are enabled by default in indices created in Elasticsearch versions 7.0.0 and later.' default: 512mb allOf: - $ref: '#/components/schemas/_types.ByteSize' age: description: 'This controls the maximum duration for which translog files are kept by each shard. Keeping more translog files increases the chance of performing an operation based sync when recovering replicas. If the translog files are not sufficient, replica recovery will fall back to a file based sync. This setting is ignored, and should not be set, if soft deletes are enabled. Soft deletes are enabled by default in indices created in Elasticsearch versions 7.0.0 and later.' default: 12h allOf: - $ref: '#/components/schemas/_types.Duration' _types.aggregations.StringStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: show_distribution: description: Shows the probability distribution for all characters. default: false type: boolean _types.analysis.BulgarianAnalyzer: type: object properties: type: type: string enum: - bulgarian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.TTestType: type: string enum: - paired - homoscedastic - heteroscedastic _types.TextSimilarityReranker: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: The nested retriever which will produce the first-level results, that will later be used for reranking. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rank_window_size: description: This value determines how many documents we will consider from the nested retriever. type: number inference_id: description: Unique identifier of the inference endpoint created using the inference API. type: string inference_text: description: The text snippet used as the basis for similarity comparison. type: string field: description: The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text. type: string chunk_rescorer: description: Whether to rescore on only the best matching chunks. x-state: Generally available; Added in 9.2.0 allOf: - $ref: '#/components/schemas/_types.ChunkRescorer' required: - retriever - inference_text - field _types.aggregations.ParentAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: type: description: The child type that should be selected. allOf: - $ref: '#/components/schemas/_types.RelationName' _types.aggregations.MaxBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _global.search._types.FieldCollapse: type: object properties: field: description: The field to collapse the result set on allOf: - $ref: '#/components/schemas/_types.Field' inner_hits: description: The number of inner hits and their sort order oneOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' - type: array items: $ref: '#/components/schemas/_global.search._types.InnerHits' max_concurrent_group_searches: description: The number of concurrent requests allowed to retrieve the inner_hits per group type: number collapse: allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' required: - field _types.DateTime: description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.' oneOf: - type: string - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' _types.query_dsl.RangeQueryBase: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: Indicates how the range query matches values for `range` fields. default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: object gte: description: Greater than or equal to. type: object lt: description: Less than. type: object lte: description: Less than or equal to. type: object _types.query_dsl.NumericDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBasedoubledouble' - type: object _types.analysis.StemmerOverrideTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stemmer_override rules: description: A list of mapping rules to use. type: array items: type: string rules_path: description: A path (either relative to `config` location, or absolute) to a list of mappings. type: string required: - type _types.aggregations.SingleBucketAggregateBase: description: Base type for single-bucket aggregation results that can hold sub-aggregations results. allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: doc_count: type: number required: - doc_count _types.aggregations.FormattableMetricAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: format: type: string indices._types.RetentionLease: type: object properties: period: allOf: - $ref: '#/components/schemas/_types.Duration' required: - period _types.aggregations.MissingAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.SingleBucketAggregateBase' - type: object _types.analysis.TokenizerDefinition: discriminator: propertyName: type mapping: char_group: '#/components/schemas/_types.analysis.CharGroupTokenizer' classic: '#/components/schemas/_types.analysis.ClassicTokenizer' edge_ngram: '#/components/schemas/_types.analysis.EdgeNGramTokenizer' icu_tokenizer: '#/components/schemas/_types.analysis.IcuTokenizer' keyword: '#/components/schemas/_types.analysis.KeywordTokenizer' kuromoji_tokenizer: '#/components/schemas/_types.analysis.KuromojiTokenizer' letter: '#/components/schemas/_types.analysis.LetterTokenizer' lowercase: '#/components/schemas/_types.analysis.LowercaseTokenizer' ngram: '#/components/schemas/_types.analysis.NGramTokenizer' nori_tokenizer: '#/components/schemas/_types.analysis.NoriTokenizer' path_hierarchy: '#/components/schemas/_types.analysis.PathHierarchyTokenizer' pattern: '#/components/schemas/_types.analysis.PatternTokenizer' simple_pattern: '#/components/schemas/_types.analysis.SimplePatternTokenizer' simple_pattern_split: '#/components/schemas/_types.analysis.SimplePatternSplitTokenizer' standard: '#/components/schemas/_types.analysis.StandardTokenizer' thai: '#/components/schemas/_types.analysis.ThaiTokenizer' uax_url_email: '#/components/schemas/_types.analysis.UaxEmailUrlTokenizer' whitespace: '#/components/schemas/_types.analysis.WhitespaceTokenizer' oneOf: - $ref: '#/components/schemas/_types.analysis.CharGroupTokenizer' - $ref: '#/components/schemas/_types.analysis.ClassicTokenizer' - $ref: '#/components/schemas/_types.analysis.EdgeNGramTokenizer' - $ref: '#/components/schemas/_types.analysis.KeywordTokenizer' - $ref: '#/components/schemas/_types.analysis.LetterTokenizer' - $ref: '#/components/schemas/_types.analysis.LowercaseTokenizer' - $ref: '#/components/schemas/_types.analysis.NGramTokenizer' - $ref: '#/components/schemas/_types.analysis.PathHierarchyTokenizer' - $ref: '#/components/schemas/_types.analysis.PatternTokenizer' - $ref: '#/components/schemas/_types.analysis.SimplePatternTokenizer' - $ref: '#/components/schemas/_types.analysis.SimplePatternSplitTokenizer' - $ref: '#/components/schemas/_types.analysis.StandardTokenizer' - $ref: '#/components/schemas/_types.analysis.ThaiTokenizer' - $ref: '#/components/schemas/_types.analysis.UaxEmailUrlTokenizer' - $ref: '#/components/schemas/_types.analysis.WhitespaceTokenizer' - $ref: '#/components/schemas/_types.analysis.IcuTokenizer' - $ref: '#/components/schemas/_types.analysis.KuromojiTokenizer' - $ref: '#/components/schemas/_types.analysis.NoriTokenizer' _types.query_dsl.UntypedRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBase' - type: object properties: format: description: Date format used to convert `date` values in the query. allOf: - $ref: '#/components/schemas/_types.DateFormat' time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert `date` values in the query to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' security.get_token.AuthenticatedUser: allOf: - $ref: '#/components/schemas/security._types.User' - type: object properties: authentication_realm: allOf: - $ref: '#/components/schemas/security.get_token.UserRealm' lookup_realm: allOf: - $ref: '#/components/schemas/security.get_token.UserRealm' authentication_provider: allOf: - $ref: '#/components/schemas/security.get_token.AuthenticationProvider' authentication_type: type: string required: - authentication_realm - lookup_realm - authentication_type _types.IndexName: type: string _types.aggregations.GeoLineSort: type: object properties: field: description: The name of the numeric field to use as the sort key for ordering the points. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.aggregations.MultiBucketAggregateBaseStringTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsStringTermsBucket' required: - buckets _types.aggregations.MultiBucketAggregateBaseDoubleTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsDoubleTermsBucket' required: - buckets _types.aggregations.MultiBucketAggregateBaseRangeBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsRangeBucket' required: - buckets _types.analysis.KuromojiPartOfSpeechTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_part_of_speech stoptags: type: array items: type: string required: - type - stoptags security._types.RestrictionWorkflow: anyOf: - type: string enum: - search_application_query - type: string _types.Uuid: type: string _types.aggregations.MultiTermLookup: allOf: - type: object properties: missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' - type: object properties: field: description: 'A field from which to retrieve terms. It is required if `script` is not provided.' allOf: - $ref: '#/components/schemas/_types.Field' script: description: 'A script to calculate terms to aggregate on. It is required if `field` is not provided.' allOf: - $ref: '#/components/schemas/_types.Script' minProperties: 1 maxProperties: 1 _types.query_dsl.DecayFunctionBaseGeoLocationDistance: type: object properties: multi_value_mode: description: Determines how the distance is calculated when a field used for computing the decay contains multiple values. default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.aggregations.CompositeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: after: description: When paginating, use the `after_key` value returned in the previous response to retrieve the next page. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregateKey' size: description: The number of composite buckets that should be returned. default: 10.0 type: number sources: description: 'The value sources used to build composite buckets. Keys are returned in the order of the `sources` definition.' type: array items: type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.CompositeAggregationSource' minProperties: 1 maxProperties: 1 _types.analysis.HyphenationDecompounderTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CompoundWordTokenFilterBase' - type: object properties: type: type: string enum: - hyphenation_decompounder hyphenation_patterns_path: description: 'Path to an Apache FOP (Formatting Objects Processor) XML hyphenation pattern file. This path must be absolute or relative to the `config` location. Only FOP v1.2 compatible files are supported.' type: string no_sub_matches: description: If `true`, do not match sub tokens in tokens that are in the word list. Defaults to `false`. type: boolean no_overlapping_matches: description: If `true`, do not allow overlapping tokens. Defaults to `false`. type: boolean required: - type - hyphenation_patterns_path _types.query_dsl.SemanticQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: The field to query, which must be a semantic_text field type type: string query: description: The query text type: string required: - field - query _types.aggregations.InferenceAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: model_id: description: The ID or alias for the trained model. allOf: - $ref: '#/components/schemas/_types.Name' inference_config: description: Contains the inference type and its options. allOf: - $ref: '#/components/schemas/_types.aggregations.InferenceConfigContainer' required: - model_id _types.analysis.ArabicAnalyzer: type: object properties: type: type: string enum: - arabic stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.HoltWintersMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - holt_winters settings: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltWintersModelSettings' required: - model - settings _types.query_dsl.TextQueryType: type: string enum: - best_fields - most_fields - cross_fields - phrase - phrase_prefix - bool_prefix _types.analysis.KuromojiIterationMarkCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - kuromoji_iteration_mark normalize_kana: type: boolean normalize_kanji: type: boolean required: - type - normalize_kana - normalize_kanji _types.analysis.StopWords: description: 'Language value, such as _arabic_ or _thai_. Defaults to _english_. Each language value corresponds to a predefined list of stop words in Lucene. See Stop words by language for supported language values and their stop words. Also accepts an array of stop words.' oneOf: - $ref: '#/components/schemas/_types.analysis.StopWordLanguage' - type: array items: type: string _types.analysis.SimplePatternSplitTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - simple_pattern_split pattern: type: string required: - type _types.aggregations.ScriptedMetricAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: combine_script: description: 'Runs once on each shard after document collection is complete. Allows the aggregation to consolidate the state returned from each shard.' allOf: - $ref: '#/components/schemas/_types.Script' init_script: description: 'Runs prior to any collection of documents. Allows the aggregation to set up any initial state.' allOf: - $ref: '#/components/schemas/_types.Script' map_script: description: 'Run once per document collected. If no `combine_script` is specified, the resulting state needs to be stored in the `state` object.' allOf: - $ref: '#/components/schemas/_types.Script' params: description: 'A global object with script parameters for `init`, `map` and `combine` scripts. It is shared between the scripts.' type: object additionalProperties: type: object reduce_script: description: 'Runs once on the coordinating node after all shards have returned their results. The script is provided with access to a variable `states`, which is an array of the result of the `combine_script` on each shard.' allOf: - $ref: '#/components/schemas/_types.Script' _types.analysis.ScandinavianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - scandinavian_normalization required: - type _types.aggregations.StatsBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.query_dsl.RangeQueryBaselong: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: Indicates how the range query matches values for `range` fields. default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: number gte: description: Greater than or equal to. type: number lt: description: Less than. type: number lte: description: Less than or equal to. type: number security._types.TemplateFormat: type: string enum: - string - json security._types.ManageUserPrivileges: type: object properties: applications: type: array items: type: string required: - applications security._types.RemoteUserIndicesPrivileges: type: object properties: clusters: type: array items: type: string field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. type: array items: $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' privileges: description: The index level privileges that owners of the role have on the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' query: description: Search queries that define the documents the user has access to. A document within the specified indices must match these queries for it to be accessible by the owners of the role. type: array items: $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. type: boolean required: - clusters - names - privileges - allow_restricted_indices _types.analysis.DictionaryDecompounderTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CompoundWordTokenFilterBase' - type: object properties: type: type: string enum: - dictionary_decompounder required: - type _types.analysis.UppercaseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - uppercase required: - type _types.aggregations.BucketPathAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: buckets_path: description: Path to the buckets that contain one set of values to correlate. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsPath' security._types.Restriction: type: object properties: workflows: description: 'A list of workflows to which the API key is restricted. NOTE: In order to use a role restriction, an API key must be created with a single role descriptor.' type: array items: $ref: '#/components/schemas/security._types.RestrictionWorkflow' required: - workflows _types.analysis.DelimitedPayloadEncoding: type: string enum: - int - float - identity _types.aggregations.AggregationRange: type: object properties: from: description: Start of the range (inclusive). oneOf: - type: number - type: - string - 'null' key: description: Custom key to return the range with. type: string to: description: End of the range (exclusive). oneOf: - type: number - type: - string - 'null' _types.DateFormat: type: string _types.analysis.CustomNormalizer: type: object properties: type: type: string enum: - custom char_filter: type: array items: type: string filter: type: array items: type: string required: - type security._types.UserIndicesPrivileges: type: object properties: field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. type: array items: $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' privileges: description: The index level privileges that owners of the role have on the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' query: description: Search queries that define the documents the user has access to. A document within the specified indices must match these queries for it to be accessible by the owners of the role. type: array items: $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. type: boolean required: - names - privileges - allow_restricted_indices _types.DiversifyRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: type: description: The diversification strategy to apply. allOf: - $ref: '#/components/schemas/_types.DiversifyRetrieverTypes' field: description: The document field on which to diversify results on. type: string retriever: description: The nested retriever whose results will be diversified. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' size: description: The number of top documents to return after diversification. type: number rank_window_size: description: The number of top documents from the nested retriever to consider for diversification. type: number query_vector: description: The query vector used for diversification. allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: a dense vector query vector builder to use instead of a static query_vector allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' lambda: description: Controls the trade-off between relevance and diversity for MMR. A value of 0.0 focuses solely on diversity, while a value of 1.0 focuses solely on relevance. Required for MMR type: number required: - type - field - retriever _types.query_dsl.TextExpansionQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: model_id: description: The text expansion NLP model to use type: string model_text: description: The query text type: string pruning_config: description: Token pruning configurations x-state: Experimental; Added in 8.13.0 allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - model_id - model_text security.query_api_keys.ApiKeyFiltersAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: filters: description: Collection of queries from which to build buckets. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsApiKeyQueryContainer' other_bucket: description: Set to `true` to add a bucket to the response which will contain all documents that do not match any of the given filters. type: boolean other_bucket_key: description: The key with which the other bucket is returned. default: _other_ type: string keyed: description: 'By default, the named filters aggregation returns the buckets as an object. Set to `false` to return the buckets as an array of objects.' default: true type: boolean _types.analysis.ClassicTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - classic required: - type _types.analysis.SimplePatternTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - simple_pattern pattern: type: string required: - type _types.analysis.SimpleAnalyzer: type: object properties: type: type: string enum: - simple version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' required: - type _types.analysis.MultiplexerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - multiplexer filters: description: A list of token filters to apply to incoming tokens. type: array items: type: string preserve_original: description: If `true` (the default) then emit the original token in addition to the filtered tokens. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type - filters security._types.CredentialManagedBy: type: string enum: - cloud - elasticsearch _types.aggregations.ExtendedStatsBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: sigma: description: The number of standard deviations above/below the mean to display. type: number _types.analysis.CjkAnalyzer: type: object properties: type: type: string enum: - cjk stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.analysis.TrimTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - trim required: - type _types.analysis.PersianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - persian_normalization required: - type _types.analysis.IndicNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - indic_normalization required: - type _types.GeoHash: type: string _types.query_dsl.WildcardQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: case_insensitive: description: Allows case insensitive matching of the pattern with the indexed field values when set to true. Default is false which means the case sensitivity of matching depends on the underlying field’s mapping. x-state: Generally available; Added in 7.10.0 type: boolean rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Wildcard pattern for terms you wish to find in the provided field. Required, when wildcard is not set. type: string wildcard: description: Wildcard pattern for terms you wish to find in the provided field. Required, when value is not set. type: string security._types.IndicesPrivileges: type: object properties: field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. allOf: - $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' privileges: description: The index level privileges that owners of the role have on the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' query: description: A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role. allOf: - $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. default: false type: boolean required: - names - privileges _global.search._types.HighlighterOrder: type: string enum: - score security.get_service_accounts.RoleDescriptorWrapper: type: object properties: role_descriptor: allOf: - $ref: '#/components/schemas/security._types.RoleDescriptorRead' required: - role_descriptor _types.query_dsl.FuzzyQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: max_expansions: description: Maximum number of variations created. default: 50.0 type: number prefix_length: description: Number of beginning characters left unchanged when creating expansions. default: 0.0 type: number rewrite: description: Number of beginning characters left unchanged when creating expansions. default: constant_score allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' transpositions: description: Indicates whether edits include transpositions of two adjacent characters (for example `ab` to `ba`). default: true type: boolean fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' value: description: Term you wish to find in the provided field. oneOf: - type: string - type: number - type: boolean required: - value security._types.RealmInfo: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' type: type: string required: - name - type _types.Id: type: string _types.InnerRetriever: type: object properties: retriever: allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' weight: type: number normalizer: allOf: - $ref: '#/components/schemas/_types.ScoreNormalizer' required: - retriever - weight - normalizer _types.query_dsl.SparseVectorQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-sparse-vector-query allOf: - type: object properties: field: description: 'The name of the field that contains the token-weight pairs to be searched against. This field must be a mapped sparse_vector field.' allOf: - $ref: '#/components/schemas/_types.Field' query: description: 'The query text you want to use for search. If inference_id is specified, query must also be specified.' type: string prune: description: 'Whether to perform pruning, omitting the non-significant tokens from the query to improve query performance. If prune is true but the pruning_config is not specified, pruning will occur but default values will be used. Default: false' x-state: Generally available; Added in 8.15.0 type: boolean pruning_config: description: 'Optional pruning configuration. If enabled, this will omit non-significant tokens from the query in order to improve query performance. This is only used if prune is set to true. If prune is set to true but pruning_config is not specified, default values will be used.' x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - field - type: object properties: query_vector: description: 'Dictionary of precomputed sparse vectors and their associated weights. Only one of inference_id or query_vector may be supplied in a request.' type: object additionalProperties: type: number inference_id: description: 'The inference ID to use to convert the query text into token-weight pairs. It must be the same inference ID that was used to create the tokens from the input text. Only one of inference_id and query_vector is allowed. If inference_id is specified, query must also be specified. Only one of inference_id or query_vector may be supplied in a request.' allOf: - $ref: '#/components/schemas/_types.Id' minProperties: 1 maxProperties: 1 _types.analysis.PhoneticNameType: type: string enum: - generic - ashkenazi - sephardic _types.aggregations.SingleMetricAggregateBase: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: value: description: 'The metric value. A missing value generally means that there was no data to aggregate, unless specified otherwise.' oneOf: - type: number - type: - string - 'null' value_as_string: type: string required: - value _types.SlicedScroll: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' id: allOf: - $ref: '#/components/schemas/_types.Id' max: type: number required: - id - max _types.aggregations.SignificantTextAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: background_filter: description: A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' chi_square: description: Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.ChiSquareHeuristic' exclude: description: Values to exclude. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: Determines whether the aggregation will use field values directly or global ordinals. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return significant text. allOf: - $ref: '#/components/schemas/_types.Field' filter_duplicate_text: description: Whether to out duplicate text to deal with noisy data. type: boolean gnd: description: Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.GoogleNormalizedDistanceHeuristic' include: description: Values to include. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' jlh: description: Use JLH score as the significance score. allOf: - $ref: '#/components/schemas/_types.EmptyObject' min_doc_count: description: Only return values that are found in more than `min_doc_count` hits. default: 3.0 type: number mutual_information: description: Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.MutualInformationHeuristic' percentage: description: A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentageScoreHeuristic' script_heuristic: description: Customized score, implemented via a script. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedHeuristic' shard_min_doc_count: description: 'Regulates the certainty a shard has if the values should actually be added to the candidate list or not with respect to the min_doc_count. Values will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number size: description: The number of buckets returned out of the overall terms list. type: number source_fields: description: Overrides the JSON `_source` fields from which text will be analyzed. allOf: - $ref: '#/components/schemas/_types.Fields' _types.aggregations.SignificantTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: background_filter: description: A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' chi_square: description: Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.ChiSquareHeuristic' exclude: description: Terms to exclude. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: 'Mechanism by which the aggregation should be executed: using field values directly or using global ordinals.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return significant terms. allOf: - $ref: '#/components/schemas/_types.Field' gnd: description: Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.GoogleNormalizedDistanceHeuristic' include: description: Terms to include. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' jlh: description: Use JLH score as the significance score. allOf: - $ref: '#/components/schemas/_types.EmptyObject' min_doc_count: description: Only return terms that are found in more than `min_doc_count` hits. default: 3.0 type: number mutual_information: description: Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.MutualInformationHeuristic' percentage: description: A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentageScoreHeuristic' script_heuristic: description: Customized score, implemented via a script. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedHeuristic' p_value: description: 'Significant terms heuristic that calculates the p-value between the term existing in foreground and background sets. The p-value is the probability of obtaining test results at least as extreme as the results actually observed, under the assumption that the null hypothesis is correct. The p-value is calculated assuming that the foreground set and the background set are independent https://en.wikipedia.org/wiki/Bernoulli_trial, with the null hypothesis that the probabilities are the same.' allOf: - $ref: '#/components/schemas/_types.aggregations.PValueHeuristic' shard_min_doc_count: description: 'Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`. Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'Can be used to control the volumes of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number size: description: The number of buckets returned out of the overall terms list. type: number indices._types.IndexSettingsUnassigned: type: object properties: node_left: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsUnassignedNodeLeft' _types.query_dsl.DistanceFeatureQueryBaseGeoLocationDistance: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' allOf: - $ref: '#/components/schemas/_types.GeoLocation' pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' allOf: - $ref: '#/components/schemas/_types.Distance' field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field _types.query_dsl.MultiValueMode: type: string enum: - min - max - avg - sum indices._types.SettingsSimilarityBoolean: type: object properties: type: type: string enum: - boolean required: - type _types.Sort: oneOf: - $ref: '#/components/schemas/_types.SortCombinations' - type: array items: $ref: '#/components/schemas/_types.SortCombinations' _types.query_dsl.TermsSetQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: minimum_should_match: description: Specification describing number of matching terms required to return a document. x-state: Generally available; Added in 8.10.0 allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' minimum_should_match_field: description: Numeric field containing the number of matching terms required to return a document. allOf: - $ref: '#/components/schemas/_types.Field' minimum_should_match_script: description: Custom script containing the number of matching terms required to return a document. allOf: - $ref: '#/components/schemas/_types.Script' terms: description: Array of terms you wish to find in the provided field. type: array items: $ref: '#/components/schemas/_types.FieldValue' required: - terms _types.aggregations.GoogleNormalizedDistanceHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean _types.aggregations.TermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: collect_mode: description: 'Determines how child aggregations should be calculated: breadth-first or depth-first.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationCollectMode' exclude: description: 'Values to exclude. Accepts regular expressions and partitions.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: Determines whether the aggregation will use field values directly or global ordinals. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return terms. allOf: - $ref: '#/components/schemas/_types.Field' include: description: 'Values to include. Accepts regular expressions and partitions.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' min_doc_count: description: Only return values that are found in more than `min_doc_count` hits. default: 1.0 type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' missing_order: allOf: - $ref: '#/components/schemas/_types.aggregations.MissingOrder' missing_bucket: type: boolean value_type: description: Coerced unmapped fields into the specified type. type: string order: description: 'Specifies the sort order of the buckets. Defaults to sorting by descending document count.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' shard_min_doc_count: description: 'Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`. Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number show_term_doc_count_error: description: Set to `true` to return the `doc_count_error_upper_bound`, which is an upper bound to the error on the `doc_count` returned by each shard. type: boolean size: description: The number of buckets returned out of the overall terms list. default: 10.0 type: number format: type: string _types.analysis.IcuCollationAlternate: type: string enum: - shifted - non-ignorable _types.analysis.IcuNormalizationMode: type: string enum: - decompose - compose _types.query_dsl.ConstantScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: filter: description: 'Filter query you wish to run. Any returned documents must match this query. Filter queries do not calculate relevance scores. To speed up performance, Elasticsearch automatically caches frequently used filter queries.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - filter _types.query_dsl.DateRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBaseDateMath' - type: object properties: format: description: Date format used to convert `date` values in the query. allOf: - $ref: '#/components/schemas/_types.DateFormat' time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert `date` values in the query to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' _types.Indices: oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' _types.query_dsl.MatchPhraseQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string query: description: Query terms that are analyzed and turned into a phrase query. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number zero_terms_query: description: Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter. default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.query_dsl.FunctionBoostMode: type: string enum: - multiply - replace - sum - avg - max - min indices._types.IndexRoutingRebalanceOptions: type: string enum: - all - primaries - replicas - none _types.query_dsl.DateDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBaseDateMathDuration' - type: object _types.query_dsl.DecayFunctionBasedoubledouble: type: object properties: multi_value_mode: description: Determines how the distance is calculated when a field used for computing the decay contains multiple values. default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' security.suggest_user_profiles.Hint: type: object properties: uids: description: A list of profile UIDs to match against. type: array items: $ref: '#/components/schemas/security._types.UserProfileId' labels: description: 'A single key-value pair to match against the labels section of a profile. A profile is considered matching if it matches at least one of the strings.' type: object additionalProperties: oneOf: - type: string - type: array items: type: string _types.analysis.TokenChar: type: string enum: - letter - digit - whitespace - punctuation - symbol - custom _types.query_dsl.HasParentQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: 'Indicates whether to ignore an unmapped `parent_type` and not return any documents instead of an error. You can use this parameter to query multiple indices that may not contain the `parent_type`.' default: false type: boolean inner_hits: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-inner-hits description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' parent_type: description: Name of the parent relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' query: description: 'Query you wish to run on parent documents of the `parent_type` field. If a parent document matches the search, the query returns its child documents.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score: description: Indicates whether the relevance score of a matching parent document is aggregated into its child documents. default: false type: boolean required: - parent_type - query _types.query_dsl.SpanMultiTermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: match: description: Should be a multi term query (one of `wildcard`, `fuzzy`, `prefix`, `range`, or `regexp` query). allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - match _types.aggregations.StringTermsAggregate: description: Result of a `terms` aggregation when the field is a string. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregateBaseStringTermsBucket' - type: object _types.SortOrder: type: string enum: - asc - desc security._types.UserProfile: type: object properties: uid: allOf: - $ref: '#/components/schemas/security._types.UserProfileId' user: allOf: - $ref: '#/components/schemas/security._types.UserProfileUser' data: type: object additionalProperties: type: object labels: type: object additionalProperties: type: object enabled: type: boolean required: - uid - user - data - labels _types.analysis.MappingCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - mapping mappings: type: array items: type: string mappings_path: type: string required: - type _types.analysis.IndonesianAnalyzer: type: object properties: type: type: string enum: - indonesian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.analysis.CharFilterBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.analysis.IrishAnalyzer: type: object properties: type: type: string enum: - irish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type security._types.RemoteIndicesPrivileges: description: The subset of index level privileges that can be defined for remote clusters. type: object properties: clusters: description: A list of cluster aliases to which the permissions in this entry apply. allOf: - $ref: '#/components/schemas/_types.Names' field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. allOf: - $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' privileges: description: The index level privileges that owners of the role have on the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' query: description: A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role. allOf: - $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. default: false type: boolean required: - clusters - names - privileges _types.query_dsl.RankFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: '`rank_feature` or `rank_features` field used to boost relevance scores.' allOf: - $ref: '#/components/schemas/_types.Field' saturation: description: Saturation function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionSaturation' log: description: Logarithmic function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionLogarithm' linear: description: Linear function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionLinear' sigmoid: description: Sigmoid function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionSigmoid' required: - field security.has_privileges_user_profile.HasPrivilegesUserProfileErrors: type: object properties: count: type: number details: type: object additionalProperties: $ref: '#/components/schemas/_types.ErrorCause' required: - count - details _types.analysis.PortugueseAnalyzer: type: object properties: type: type: string enum: - portuguese stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.HoltMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - holt settings: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltLinearModelSettings' required: - model - settings indices._types.Storage: type: object properties: type: allOf: - $ref: '#/components/schemas/indices._types.StorageType' allow_mmap: description: 'You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.' type: boolean stats_refresh_interval: description: How often store statistics are refreshed allOf: - $ref: '#/components/schemas/_types.Duration' required: - type _types.analysis.DelimitedPayloadTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - delimited_payload delimiter: description: Character used to separate tokens from payloads. Defaults to `|`. type: string encoding: description: Data type for the stored payload. allOf: - $ref: '#/components/schemas/_types.analysis.DelimitedPayloadEncoding' required: - type _types.analysis.SynonymTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilterBase' - type: object properties: type: type: string enum: - synonym required: - type _types.query_dsl.SpanFirstQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: end: description: Controls the maximum end position permitted in a match. type: number match: description: Can be any other span type query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - end - match indices._types.Queries: type: object properties: cache: allOf: - $ref: '#/components/schemas/indices._types.CacheQueries' _types.query_dsl.MatchBoolPrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string fuzziness: description: 'Maximum edit distance allowed for matching. Can be applied to the term subqueries constructed for all terms but the final term.' allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: 'Method used to rewrite the query. Can be applied to the term subqueries constructed for all terms but the final term.' allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: 'If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). Can be applied to the term subqueries constructed for all terms but the final term.' default: true type: boolean max_expansions: description: 'Maximum number of terms to which the query will expand. Can be applied to the term subqueries constructed for all terms but the final term.' default: 50.0 type: number minimum_should_match: description: 'Minimum number of clauses that must match for a document to be returned. Applied to the constructed bool query.' allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: 'Boolean logic used to interpret text in the query value. Applied to the constructed bool query.' default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: 'Number of beginning characters left unchanged for fuzzy matching. Can be applied to the term subqueries constructed for all terms but the final term.' default: 0.0 type: number query: description: 'Terms you wish to find in the provided field. The last term is used in a prefix query.' type: string required: - query _types.RuleRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: ruleset_ids: description: The ruleset IDs containing the rules this retriever is evaluating against. oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' match_criteria: description: The match criteria that will determine if a rule in the provided rulesets should be applied. type: object retriever: description: The retriever whose results rules should be applied to. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rank_window_size: description: This value determines the size of the individual result set. type: number required: - ruleset_ids - match_criteria - retriever _types.analysis.DutchStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - dutch_stem required: - type _types.analysis.FinnishAnalyzer: type: object properties: type: type: string enum: - finnish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.IndexingSlowlogTresholds: type: object properties: index: description: 'The indexing slow log, similar in functionality to the search slow log. The log file name ends with `_index_indexing_slowlog.json`. Log and the thresholds are configured in the same way as the search slowlog.' allOf: - $ref: '#/components/schemas/indices._types.SlowlogTresholdLevels' _types.analysis.StopWordLanguage: type: string enum: - _arabic_ - _armenian_ - _basque_ - _bengali_ - _brazilian_ - _bulgarian_ - _catalan_ - _cjk_ - _czech_ - _danish_ - _dutch_ - _english_ - _estonian_ - _finnish_ - _french_ - _galician_ - _german_ - _greek_ - _hindi_ - _hungarian_ - _indonesian_ - _irish_ - _italian_ - _latvian_ - _lithuanian_ - _norwegian_ - _persian_ - _portuguese_ - _romanian_ - _russian_ - _serbian_ - _sorani_ - _spanish_ - _swedish_ - _thai_ - _turkish_ - _none_ _types.query_dsl.FieldValueFactorModifier: type: string enum: - none - log - log1p - log2p - ln - ln1p - ln2p - square - sqrt - reciprocal _types.aggregations.ValueCountAggregate: description: Value count aggregation result. `value` is always present. allOf: - $ref: '#/components/schemas/_types.aggregations.SingleMetricAggregateBase' - type: object _types.GeoHashPrecision: description: A precision that can be expressed as a geohash length between 1 and 12, or a distance measure like "1km", "10m". oneOf: - type: number - type: string security._types.RoleDescriptorRead: type: object properties: cluster: description: A list of cluster privileges. These privileges define the cluster level actions that API keys are able to execute. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' indices: description: A list of indices permissions entries. type: array items: $ref: '#/components/schemas/security._types.IndicesPrivileges' remote_indices: description: A list of indices permissions for remote clusters. x-state: Generally available; Added in 8.14.0 type: array items: $ref: '#/components/schemas/security._types.RemoteIndicesPrivileges' remote_cluster: description: 'A list of cluster permissions for remote clusters. NOTE: This is limited a subset of the cluster permissions.' x-state: Generally available; Added in 8.15.0 type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivileges' global: description: An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. oneOf: - type: array items: $ref: '#/components/schemas/security._types.GlobalPrivilege' - $ref: '#/components/schemas/security._types.GlobalPrivilege' applications: description: A list of application privilege entries type: array items: $ref: '#/components/schemas/security._types.ApplicationPrivileges' metadata: description: Optional meta-data. Within the metadata object, keys that begin with `_` are reserved for system usage. allOf: - $ref: '#/components/schemas/_types.Metadata' run_as: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/submitting-requests-on-behalf-of-other-users description: 'A list of users that the API keys can impersonate. NOTE: In Elastic Cloud Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty `run_as` field, but a non-empty list will be rejected.' type: array items: type: string description: description: Optional description of the role descriptor type: string restriction: description: Restriction for when the role descriptor is allowed to be effective. allOf: - $ref: '#/components/schemas/security._types.Restriction' transient_metadata: type: object additionalProperties: type: object required: - cluster - indices _types.analysis.FingerprintTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - fingerprint max_output_size: description: Maximum character length, including whitespace, of the output token. Defaults to `255`. Concatenated tokens longer than this will result in no token output. type: number separator: description: Character to use to concatenate the token stream input. Defaults to a space. type: string required: - type _types.analysis.LetterTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - letter required: - type _types.Fields: oneOf: - $ref: '#/components/schemas/_types.Field' - type: array items: $ref: '#/components/schemas/_types.Field' _types.ulong: type: number _types.analysis.IcuTransformDirection: type: string enum: - forward - reverse _spec_utils.Stringifiedboolean: description: 'Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type. Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.' oneOf: - type: boolean - type: string _types.query_dsl.SpanNearQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: clauses: description: Array of one or more other span type queries. type: array items: $ref: '#/components/schemas/_types.query_dsl.SpanQuery' in_order: description: Controls whether matches are required to be in-order. type: boolean slop: description: Controls the maximum number of intervening unmatched positions permitted. type: number required: - clauses _global.search._types.ScoreMode: type: string enum: - avg - max - min - multiply - total _types.aggregations.PercentageScoreHeuristic: type: object _types.analysis.StopTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stop ignore_case: description: If `true`, stop word matching is case insensitive. For example, if `true`, a stop word of the matches and removes `The`, `THE`, or `the`. Defaults to `false`. type: boolean remove_trailing: description: If `true`, the last token of a stream is removed if it’s a stop word. Defaults to `true`. type: boolean stopwords: description: Language value, such as `_arabic_` or `_thai_`. Defaults to `_english_`. allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: 'Path to a file that contains a list of stop words to remove. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each stop word in the file must be separated by a line break.' type: string required: - type _types.analysis.ThaiTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - thai required: - type _types.analysis.PatternAnalyzer: type: object properties: type: type: string enum: - pattern version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' flags: description: Java regular expression flags. Flags should be pipe-separated, eg "CASE_INSENSITIVE|COMMENTS". type: string lowercase: description: 'Should terms be lowercased or not. Defaults to `true`.' default: true type: boolean pattern: description: 'A Java regular expression. Defaults to `\W+`.' default: \W+ type: string stopwords: description: 'A pre-defined stop words list like `_english_` or an array containing a list of stop words. Defaults to `_none_`.' default: _none_ allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: The path to a file containing stop words. type: string required: - type _types.query_dsl.IntervalsFuzzy: type: object properties: analyzer: description: Analyzer used to normalize the term. type: string fuzziness: description: Maximum edit distance allowed for matching. default: auto allOf: - $ref: '#/components/schemas/_types.Fuzziness' prefix_length: description: Number of beginning characters left unchanged when creating expansions. default: 0.0 type: number term: description: The term to match. type: string transpositions: description: Indicates whether edits include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `term` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - term _types.aggregations.MutualInformationHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean include_negatives: description: Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset. type: boolean _types.analysis.IcuFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_folding unicode_set_filter: type: string required: - type - unicode_set_filter _types.analysis.HtmlStripCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - html_strip escaped_tags: type: array items: type: string required: - type _types.aggregations.GeoLineAggregation: type: object properties: point: description: The name of the geo_point field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLinePoint' sort: description: 'The name of the numeric field to use as the sort key for ordering the points. When the `geo_line` aggregation is nested inside a `time_series` aggregation, this field defaults to `@timestamp`, and any other value will result in error.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineSort' include_sort: description: When `true`, returns an additional array of the sort values in the feature properties. type: boolean sort_order: description: The order in which the line is sorted (ascending or descending). default: asc allOf: - $ref: '#/components/schemas/_types.SortOrder' size: description: 'The maximum length of the line represented in the aggregation. Valid sizes are between 1 and 10000.' default: 10000.0 type: number required: - point _types.analysis.PatternReplaceCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - pattern_replace flags: type: string pattern: type: string replacement: type: string required: - type - pattern _types.PinnedRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: Inner retriever. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' ids: type: array items: type: string docs: type: array items: $ref: '#/components/schemas/_types.SpecifiedDocument' rank_window_size: type: number required: - retriever _types.RRFRetrieverComponent: description: Wraps a retriever with an optional weight for RRF scoring. type: object properties: retriever: description: The nested retriever configuration. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' weight: description: Weight multiplier for this retriever's contribution to the RRF score. Higher values increase influence. Defaults to 1.0 if not specified. Must be non-negative. default: 1.0 type: number required: - retriever _types.analysis.PhoneticEncoder: type: string enum: - metaphone - double_metaphone - soundex - refined_soundex - caverphone1 - caverphone2 - cologne - nysiis - koelnerphonetik - haasephonetik - beider_morse - daitch_mokotoff _types.analysis.DutchAnalyzer: type: object properties: type: type: string enum: - dutch stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.SettingsSimilarityScripted: type: object properties: type: type: string enum: - scripted script: allOf: - $ref: '#/components/schemas/_types.Script' weight_script: allOf: - $ref: '#/components/schemas/_types.Script' required: - type - script indices._types.IndexSettingsLifecycleStep: type: object properties: wait_time_threshold: description: 'Time to wait for the cluster to resolve allocation issues during an ILM shrink action. Must be greater than 1h (1 hour). See Shard allocation for shrink.' allOf: - $ref: '#/components/schemas/_types.Duration' _types.ScriptField: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' ignore_failure: type: boolean required: - script _types.analysis.SnowballAnalyzer: type: object properties: type: type: string enum: - snowball version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' language: allOf: - $ref: '#/components/schemas/_types.analysis.SnowballLanguage' stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' required: - type - language _types.analysis.SoraniNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - sorani_normalization required: - type _types.analysis.FrenchAnalyzer: type: object properties: type: type: string enum: - french stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.query_dsl.CombinedFieldsOperator: type: string enum: - or - and _types.aggregations.EwmaMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - ewma settings: allOf: - $ref: '#/components/schemas/_types.aggregations.EwmaModelSettings' required: - model - settings _types.aggregations.AutoDateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: buckets: description: The target number of buckets. default: 10.0 type: number field: description: The field on which to run the aggregation. allOf: - $ref: '#/components/schemas/_types.Field' format: description: 'The date format used to format `key_as_string` in the response. If no `format` is specified, the first date format specified in the field mapping is used.' type: string minimum_interval: description: 'The minimum rounding interval. This can make the collection process more efficient, as the aggregation will not attempt to round at any interval lower than `minimum_interval`.' oneOf: - $ref: '#/components/schemas/_types.aggregations.MinimumInterval' - type: - string - 'null' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.DateTime' offset: description: Time zone specified as a ISO 8601 UTC offset. type: string params: type: object additionalProperties: type: object script: allOf: - $ref: '#/components/schemas/_types.Script' time_zone: description: Time zone ID. allOf: - $ref: '#/components/schemas/_types.TimeZone' _types.analysis.ThaiAnalyzer: type: object properties: type: type: string enum: - thai stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.aggregations.PercentileRanksAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: keyed: description: 'By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array. Set to `false` to disable this behavior.' default: true type: boolean values: description: An array of values for which to calculate the percentile ranks. oneOf: - type: array items: type: number - type: - string - 'null' hdr: description: Uses the alternative High Dynamic Range Histogram algorithm to calculate percentile ranks. allOf: - $ref: '#/components/schemas/_types.aggregations.HdrMethod' tdigest: description: Sets parameters for the default TDigest algorithm used to calculate percentile ranks. allOf: - $ref: '#/components/schemas/_types.aggregations.TDigest' _types.query_dsl.RuleQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: organic: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' ruleset_ids: oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' ruleset_id: type: string match_criteria: type: object required: - organic - match_criteria _types.query_dsl.Operator: type: string enum: - and - AND - or - OR security._types.RolesStats: type: object properties: dls: description: Document-level security (DLS) statistics. allOf: - $ref: '#/components/schemas/xpack.usage.SecurityRolesDls' required: - dls indices._types.MappingLimitSettingsSourceFields: type: object properties: mode: allOf: - $ref: '#/components/schemas/indices._types.SourceMode' required: - mode ml._types.ClassificationInferenceOptions: type: object properties: num_top_classes: description: Specifies the number of top class predictions to return. Defaults to 0. type: number num_top_feature_importance_values: description: Specifies the maximum number of feature importance values per document. default: 0.0 type: number prediction_field_type: description: 'Specifies the type of the predicted field to write. Acceptable values are: string, number, boolean. When boolean is provided 1.0 is transformed to true and 0.0 to false.' type: string results_field: description: The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value. type: string top_classes_results_field: description: Specifies the field to which the top classes are written. Defaults to top_classes. type: string _types.analysis.HindiAnalyzer: type: object properties: type: type: string enum: - hindi stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type security._types.CreatedStatus: type: object properties: created: type: boolean required: - created _types.query_dsl.RankFeatureFunctionLinear: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object _types.RrfRank: allOf: - $ref: '#/components/schemas/_types.RankBase' - type: object properties: rank_constant: description: How much influence documents in individual result sets per query have over the final ranked result set type: number rank_window_size: description: Size of the individual result sets per query type: number security._types.RoleTemplate: type: object properties: format: allOf: - $ref: '#/components/schemas/security._types.TemplateFormat' template: allOf: - $ref: '#/components/schemas/_types.Script' required: - template _types.aggregations.PipelineAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: format: description: '`DecimalFormat` pattern for the output value. If specified, the formatted value is returned in the aggregation’s `value_as_string` property.' type: string gap_policy: description: Policy to apply when gaps are found in the data. default: skip allOf: - $ref: '#/components/schemas/_types.aggregations.GapPolicy' _types.analysis.ApostropheTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - apostrophe required: - type _types.KnnSearch: type: object properties: field: description: The name of the vector field to search against allOf: - $ref: '#/components/schemas/_types.Field' query_vector: description: The query vector allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: The query vector builder. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' k: description: The final number of nearest neighbors to return as top hits type: number num_candidates: description: The number of nearest neighbor candidates to consider per shard type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number boost: description: Boost value to apply to kNN scores type: number filter: description: Filters for the kNN search query oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' similarity: description: The minimum similarity for a vector to be considered a match type: number inner_hits: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-inner-hits description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' _name: type: string required: - field _types.query_dsl.FunctionScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: boost_mode: description: Defines how he newly computed score is combined with the score of the query default: multiply allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionBoostMode' functions: description: One or more functions that compute a new score for each document returned by the query. type: array items: $ref: '#/components/schemas/_types.query_dsl.FunctionScoreContainer' max_boost: description: Restricts the new score to not exceed the provided limit. type: number min_score: description: Excludes documents that do not meet the provided score threshold. type: number query: description: A query that determines the documents for which a new score is computed. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: Specifies how the computed scores are combined default: multiply allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionScoreMode' _types.analysis.BasqueAnalyzer: type: object properties: type: type: string enum: - basque stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.SlowlogTresholds: type: object properties: query: allOf: - $ref: '#/components/schemas/indices._types.SlowlogTresholdLevels' fetch: allOf: - $ref: '#/components/schemas/indices._types.SlowlogTresholdLevels' security._types.GlobalPrivilege: type: object properties: application: allOf: - $ref: '#/components/schemas/security._types.ApplicationGlobalUserPrivileges' data_source: description: A list of data source privilege entries, used to grant access to ES|QL data sources. x-state: Generally available; Added in 9.5.0 type: array items: $ref: '#/components/schemas/security._types.DataSourcePrivileges' required: - application _types.analysis.EstonianAnalyzer: type: object properties: type: type: string enum: - estonian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type security.query_user.QueryUser: allOf: - $ref: '#/components/schemas/security._types.User' - type: object properties: _sort: allOf: - $ref: '#/components/schemas/_types.SortResults' _types.aggregations.DoubleTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.TermsBucketBase' - type: object properties: key: type: number key_as_string: type: string required: - key _types.mapping.CompositeSubField: type: object properties: type: allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFieldType' required: - type _types.analysis.LatvianAnalyzer: type: object properties: type: type: string enum: - latvian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.query_dsl.GeoShapeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean _types.analysis.SynonymGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilterBase' - type: object properties: type: type: string enum: - synonym_graph required: - type indices._types.SearchIdle: type: object properties: after: default: 30s allOf: - $ref: '#/components/schemas/_types.Duration' _types.aggregations.MovingFunctionAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script that should be executed on each window of data. type: string shift: description: 'By default, the window consists of the last n values excluding the current bucket. Increasing `shift` by 1, moves the starting window position by 1 to the right.' default: 0.0 type: number window: description: The size of window to "slide" across the histogram. type: number xpack.usage.SecurityRolesDls: type: object properties: bit_set_cache: allOf: - $ref: '#/components/schemas/xpack.usage.SecurityRolesDlsBitSetCache' required: - bit_set_cache _types.query_dsl.FieldAndFormat: description: A reference to a field with formatting instructions on how to return the value type: object properties: field: description: A wildcard pattern. The request returns values for field names matching this pattern. allOf: - $ref: '#/components/schemas/_types.Field' format: description: The format in which the values are returned. type: string include_unmapped: type: boolean required: - field _types.GeoHexCell: description: A map hex cell (H3) reference type: string indices._types.IndexSettingBlocks: type: object properties: read_only: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' read_only_allow_delete: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' read: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' write: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' metadata: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' _types.aggregations.BucketsFiltersBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.FiltersBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.FiltersBucket' _types.aggregations.TopMetricsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: metrics: description: The fields of the top document to return. oneOf: - $ref: '#/components/schemas/_types.aggregations.TopMetricsValue' - type: array items: $ref: '#/components/schemas/_types.aggregations.TopMetricsValue' size: description: The number of top documents from which to return metrics. default: 1.0 type: number sort: description: The sort order of the documents. allOf: - $ref: '#/components/schemas/_types.Sort' security.get_role.Role: type: object properties: cluster: type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' indices: type: array items: $ref: '#/components/schemas/security.get_role.IndicesPrivilegesRead' remote_indices: x-state: Generally available; Added in 8.14.0 type: array items: $ref: '#/components/schemas/security._types.RemoteIndicesPrivileges' remote_cluster: x-state: Generally available; Added in 8.15.0 type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivileges' metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' description: type: string run_as: type: array items: type: string transient_metadata: type: object additionalProperties: type: object applications: type: array items: $ref: '#/components/schemas/security._types.ApplicationPrivileges' role_templates: type: array items: $ref: '#/components/schemas/security._types.RoleTemplate' global: x-state: Generally available; Added in 8.0.0 type: object additionalProperties: type: object additionalProperties: type: object additionalProperties: type: array items: type: string required: - cluster - indices - metadata - applications _types.analysis.PatternCaptureTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - pattern_capture patterns: description: A list of regular expressions to match. type: array items: type: string preserve_original: description: If set to `true` (the default) it will emit the original token. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type - patterns _types.GeoHashLocation: type: object properties: geohash: allOf: - $ref: '#/components/schemas/_types.GeoHash' required: - geohash _types.analysis.WordDelimiterTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilterBase' - type: object properties: type: type: string enum: - word_delimiter required: - type security.authenticate.AuthenticateApiKey: type: object properties: id: allOf: - $ref: '#/components/schemas/_types.Id' name: allOf: - $ref: '#/components/schemas/_types.Name' managed_by: allOf: - $ref: '#/components/schemas/security._types.CredentialManagedBy' internal: type: boolean required: - id - managed_by _types.Password: type: string _types.SortOptions: type: object properties: _score: allOf: - $ref: '#/components/schemas/_types.ScoreSort' _doc: allOf: - $ref: '#/components/schemas/_types.ScoreSort' _geo_distance: allOf: - $ref: '#/components/schemas/_types.GeoDistanceSort' _script: allOf: - $ref: '#/components/schemas/_types.ScriptSort' minProperties: 1 maxProperties: 1 _types.aggregations.BoxplotAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' indices._types.IndexSettings: type: object properties: index: allOf: - $ref: '#/components/schemas/indices._types.IndexSettings' mode: type: string routing_path: oneOf: - type: string - type: array items: type: string soft_deletes: allOf: - $ref: '#/components/schemas/indices._types.SoftDeletes' sort: allOf: - $ref: '#/components/schemas/indices._types.IndexSegmentSort' number_of_shards: default: '1' oneOf: - type: number - type: string number_of_replicas: default: '0' oneOf: - type: number - type: string number_of_routing_shards: type: number check_on_startup: default: 'false' allOf: - $ref: '#/components/schemas/indices._types.IndexCheckOnStartup' codec: default: LZ4 type: string routing_partition_size: default: '1' allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' load_fixed_bitset_filters_eagerly: default: true type: boolean hidden: default: 'false' oneOf: - type: boolean - type: string auto_expand_replicas: default: 'false' oneOf: - type: string - $ref: '#/components/schemas/_spec_utils.NullValue' merge: allOf: - $ref: '#/components/schemas/indices._types.Merge' search: allOf: - $ref: '#/components/schemas/indices._types.SettingsSearch' refresh_interval: default: 1s allOf: - $ref: '#/components/schemas/_types.Duration' max_result_window: default: 10000.0 type: number max_inner_result_window: default: 100.0 type: number max_rescore_window: default: 10000.0 type: number max_docvalue_fields_search: default: 100.0 type: number max_script_fields: default: 32.0 type: number max_ngram_diff: default: 1.0 type: number max_shingle_diff: default: 3.0 type: number blocks: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingBlocks' max_refresh_listeners: type: number analyze: externalDocs: url: https://www.elastic.co/docs/manage-data/data-store/text-analysis/specify-an-analyzer#update-analyzers-on-existing-indices description: 'Settings to define analyzers, tokenizers, token filters and character filters. Refer to the linked documentation for step-by-step examples of updating analyzers on existing indices.' allOf: - $ref: '#/components/schemas/indices._types.SettingsAnalyze' highlight: allOf: - $ref: '#/components/schemas/indices._types.SettingsHighlight' max_terms_count: default: 65536.0 type: number max_regex_length: default: 1000.0 type: number routing: allOf: - $ref: '#/components/schemas/indices._types.IndexRouting' unassigned: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsUnassigned' gc_deletes: default: 60s allOf: - $ref: '#/components/schemas/_types.Duration' default_pipeline: default: _none allOf: - $ref: '#/components/schemas/_types.PipelineName' final_pipeline: default: _none allOf: - $ref: '#/components/schemas/_types.PipelineName' lifecycle: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsLifecycle' provided_name: allOf: - $ref: '#/components/schemas/_types.Name' creation_date: allOf: - $ref: '#/components/schemas/_spec_utils.StringifiedEpochTimeUnitMillis' creation_date_string: allOf: - $ref: '#/components/schemas/_types.DateTime' uuid: allOf: - $ref: '#/components/schemas/_types.Uuid' version: allOf: - $ref: '#/components/schemas/indices._types.IndexVersioning' verified_before_close: oneOf: - type: boolean - type: string format: oneOf: - type: string - type: number max_slices_per_scroll: type: number translog: allOf: - $ref: '#/components/schemas/indices._types.Translog' query_string: allOf: - $ref: '#/components/schemas/indices._types.SettingsQueryString' priority: oneOf: - type: number - type: string top_metrics_max_size: type: number analysis: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsAnalysis' settings: allOf: - $ref: '#/components/schemas/indices._types.IndexSettings' time_series: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsTimeSeries' queries: allOf: - $ref: '#/components/schemas/indices._types.Queries' similarity: description: Configure custom similarity settings to customize how search results are scored. type: object additionalProperties: $ref: '#/components/schemas/indices._types.SettingsSimilarity' mapping: description: Enable or disable dynamic mapping for an index. allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettings' indexing.slowlog: allOf: - $ref: '#/components/schemas/indices._types.IndexingSlowlogSettings' indexing_pressure: description: Configure indexing back pressure limits. allOf: - $ref: '#/components/schemas/indices._types.IndexingPressure' store: description: The store module allows you to control how index data is stored and accessed on disk. allOf: - $ref: '#/components/schemas/indices._types.Storage' _types.analysis.PredicateTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - predicate_token_filter script: description: Script containing a condition used to filter incoming tokens. Only tokens that match this script are included in the output. allOf: - $ref: '#/components/schemas/_types.Script' required: - type - script _types.ByteSize: oneOf: - type: number - type: string _types.analysis.SwedishAnalyzer: type: object properties: type: type: string enum: - swedish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.TermsAggregateBaseDoubleTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseDoubleTermsBucket' - type: object properties: doc_count_error_upper_bound: type: number sum_other_doc_count: type: number _types.query_dsl.TermsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object security.query_role.QueryRole: allOf: - $ref: '#/components/schemas/security._types.RoleDescriptor' - type: object properties: _sort: allOf: - $ref: '#/components/schemas/_types.SortResults' name: description: Name of the role. type: string required: - name _global.search._types.BoundaryScanner: type: string enum: - chars - sentence - word _types.ScoreNormalizer: type: string enum: - none - minmax - l2_norm security._types.UserProfileHitMetadata: type: object properties: _primary_term: type: number _seq_no: allOf: - $ref: '#/components/schemas/_types.SequenceNumber' required: - _primary_term - _seq_no _types.analysis.IcuNormalizationCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - icu_normalizer mode: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationMode' name: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationType' unicode_set_filter: type: string required: - type _types.aggregations.GeohexGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geohex_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: 'Integer zoom of the key used to defined cells or buckets in the results. Value should be between 0-15.' default: 6.0 type: number bounds: description: Bounding box used to filter the geo-points in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' size: description: Maximum number of buckets to return. default: 10000.0 type: number shard_size: description: Number of buckets returned from each shard. type: number required: - field _types.Field: description: Path to field or array of paths. Some API's support wildcards in the path to select multiple fields. type: string indices._types.SettingsQueryString: type: object properties: lenient: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - lenient _types.analysis.NGramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - ngram max_gram: description: Maximum length of characters in a gram. Defaults to `2`. type: number min_gram: description: Minimum length of characters in a gram. Defaults to `1`. type: number preserve_original: description: Emits original token when set to `true`. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.query_dsl.RankFeatureFunctionSaturation: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: pivot: description: Configurable pivot value so that the result will be less than 0.5. type: number _types.aggregations.StatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.analysis.ElisionTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - elision articles: description: 'List of elisions to remove. To be removed, the elision must be at the beginning of a token and be immediately followed by an apostrophe. Both the elision and apostrophe are removed. For custom `elision` filters, either this parameter or `articles_path` must be specified.' type: array items: type: string articles_path: description: 'Path to a file that contains a list of elisions to remove. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each elision in the file must be separated by a line break. To be removed, the elision must be at the beginning of a token and be immediately followed by an apostrophe. Both the elision and apostrophe are removed. For custom `elision` filters, either this parameter or `articles` must be specified.' type: string articles_case: description: If `true`, elision matching is case insensitive. If `false`, elision matching is case sensitive. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.analysis.LithuanianAnalyzer: type: object properties: type: type: string enum: - lithuanian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.GeoDistanceSort: type: object properties: mode: allOf: - $ref: '#/components/schemas/_types.SortMode' distance_type: allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' ignore_unmapped: type: boolean order: allOf: - $ref: '#/components/schemas/_types.SortOrder' unit: allOf: - $ref: '#/components/schemas/_types.DistanceUnit' nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' _types.DateMath: type: string security.put_privileges.Actions: type: object properties: actions: type: array items: type: string application: type: string name: allOf: - $ref: '#/components/schemas/_types.Name' metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' required: - actions _types.aggregations.TermsAggregateBaseStringTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseStringTermsBucket' - type: object properties: doc_count_error_upper_bound: type: number sum_other_doc_count: type: number _types.analysis.KeywordMarkerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keyword_marker ignore_case: description: If `true`, matching for the `keywords` and `keywords_path` parameters ignores letter case. Defaults to `false`. type: boolean keywords: description: 'Array of keywords. Tokens that match these keywords are not stemmed. This parameter, `keywords_path`, or `keywords_pattern` must be specified. You cannot specify this parameter and `keywords_pattern`.' oneOf: - type: string - type: array items: type: string keywords_path: description: 'Path to a file that contains a list of keywords. Tokens that match these keywords are not stemmed. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each word in the file must be separated by a line break. This parameter, `keywords`, or `keywords_pattern` must be specified. You cannot specify this parameter and `keywords_pattern`.' type: string keywords_pattern: description: 'Java regular expression used to match tokens. Tokens that match this expression are marked as keywords and not stemmed. This parameter, `keywords`, or `keywords_path` must be specified. You cannot specify this parameter and `keywords` or `keywords_pattern`.' type: string required: - type security._types.RoleTemplateQuery: type: object properties: template: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level#templating-role-query description: 'When you create a role, you can specify a query that defines the document level security permissions. You can optionally use Mustache templates in the role query to insert the username of the current authenticated user into the role. Like other places in Elasticsearch that support templating or scripting, you can specify inline, stored, or file-based templates and define custom parameters. You access the details for the current authenticated user through the _user parameter.' allOf: - $ref: '#/components/schemas/security._types.RoleTemplateScript' security._types.RemoteClusterPrivilege: type: string enum: - monitor_enrich - monitor_stats _types.mapping.RuntimeFields: type: object additionalProperties: $ref: '#/components/schemas/_types.mapping.RuntimeField' security.has_privileges.ApplicationPrivilegesCheck: type: object properties: application: description: The name of the application. type: string privileges: description: 'A list of the privileges that you want to check for the specified resources. It may be either application privilege names or the names of actions that are granted by those privileges' type: array items: type: string resources: description: A list of resource names against which the privileges should be checked. type: array items: type: string required: - application - privileges - resources _types.TimeZone: type: string _types.analysis.KeywordTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - keyword buffer_size: default: 256.0 type: number required: - type _types.query_dsl.MatchPhrasePrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert text in the query value into tokens. type: string max_expansions: description: Maximum number of terms to which the last provided term of the query value will expand. default: 50.0 type: number query: description: Text you wish to find in the provided field. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number zero_terms_query: description: Indicates whether no documents are returned if the analyzer removes all tokens, such as when using a `stop` filter. default: none allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.analysis.KeepTypesMode: type: string enum: - include - exclude _types.aggregations.CartesianCentroidAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object _types.Embedding: type: object properties: inference_id: type: string input: allOf: - $ref: '#/components/schemas/_types.KnnEmbeddingInput' timeout: allOf: - $ref: '#/components/schemas/_types.Duration' required: - input _types.analysis.TokenFilter: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/token-filter-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.TokenFilterDefinition' _types.analysis.CustomAnalyzer: type: object properties: type: type: string enum: - custom char_filter: oneOf: - type: string - type: array items: type: string filter: oneOf: - type: string - type: array items: type: string position_increment_gap: type: number position_offset_gap: type: number tokenizer: type: string required: - type - tokenizer _types.analysis.EdgeNGramTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - edge_ngram custom_token_chars: type: string max_gram: type: number min_gram: type: number token_chars: default: [] type: array items: $ref: '#/components/schemas/_types.analysis.TokenChar' required: - type _types.query_dsl.SpanTermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: allOf: - $ref: '#/components/schemas/_types.FieldValue' required: - value _types.aggregations.MultiBucketAggregateBaseCompositeBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsCompositeBucket' required: - buckets _types.CoordsGeoBounds: type: object properties: top: type: number bottom: type: number left: type: number right: type: number required: - top - bottom - left - right _types.query_dsl.MultiMatchQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean cutoff_frequency: deprecated: true type: number fields: description: 'The fields to be queried. Defaults to the `index.query.default_field` index settings, which in turn defaults to `*`.' allOf: - $ref: '#/components/schemas/_types.Fields' fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: 'If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). Can be applied to the term subqueries constructed for all terms but the final term.' default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text query value for a numeric field, are ignored. default: false type: boolean max_expansions: description: Maximum number of terms to which the query will expand. default: 50.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: Boolean logic used to interpret text in the query value. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number query: description: Text, number, boolean value or date you wish to find in the provided field. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number tie_breaker: description: Determines how scores for each per-term blended query and scores across groups are combined. default: 0.0 type: number type: description: How `the` multi_match query is executed internally. default: '''best_fields''' allOf: - $ref: '#/components/schemas/_types.query_dsl.TextQueryType' zero_terms_query: description: Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter. default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.analysis.BrazilianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - brazilian_stem required: - type _types.InferenceStringGroup: oneOf: - $ref: '#/components/schemas/_types.InferenceString' - type: array items: $ref: '#/components/schemas/_types.InferenceString' _types.query_dsl.GeoExecution: type: string enum: - memory - indexed _types.aggregations.MetricAggregationBase: type: object properties: field: description: The field on which to run the aggregation. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' script: allOf: - $ref: '#/components/schemas/_types.Script' _types.query_dsl.UntypedDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBase' - type: object _types.Script: type: object properties: source: description: The script source. allOf: - $ref: '#/components/schemas/_types.ScriptSource' id: description: The `id` for a stored script. allOf: - $ref: '#/components/schemas/_types.Id' params: description: 'Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.' type: object additionalProperties: type: object lang: description: Specifies the language the script is written in. default: painless allOf: - $ref: '#/components/schemas/_types.ScriptLanguage' options: type: object additionalProperties: type: string indices._types.SlowlogTresholdLevels: type: object properties: warn: allOf: - $ref: '#/components/schemas/_types.Duration' info: allOf: - $ref: '#/components/schemas/_types.Duration' debug: allOf: - $ref: '#/components/schemas/_types.Duration' trace: allOf: - $ref: '#/components/schemas/_types.Duration' _types.query_dsl.ChildScoreMode: type: string enum: - none - avg - sum - max - min _types.analysis.AsciiFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - asciifolding preserve_original: description: If `true`, emit both original tokens and folded tokens. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.aggregations.CompositeAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseCompositeBucket' - type: object properties: after_key: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregateKey' _types.GeoLocation: description: 'A latitude/longitude as a 2 dimensional point. It can be represented in various ways: - as a `{lat, long}` object - as a geo hash value - as a `[lon, lat]` array - as a string in `", "` or WKT point formats' oneOf: - $ref: '#/components/schemas/_types.LatLonGeoLocation' - $ref: '#/components/schemas/_types.GeoHashLocation' - type: array items: type: number - type: string _types.aggregations.CompositeAggregationBase: type: object properties: field: description: Either `field` or `script` must be present allOf: - $ref: '#/components/schemas/_types.Field' missing_bucket: type: boolean missing_order: allOf: - $ref: '#/components/schemas/_types.aggregations.MissingOrder' script: description: Either `field` or `script` must be present allOf: - $ref: '#/components/schemas/_types.Script' value_type: allOf: - $ref: '#/components/schemas/_types.aggregations.ValueType' order: allOf: - $ref: '#/components/schemas/_types.SortOrder' security.has_privileges.ApplicationsPrivileges: type: object additionalProperties: $ref: '#/components/schemas/security.has_privileges.ResourcePrivileges' indices._types.IndexRouting: type: object properties: allocation: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingAllocation' rebalance: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingRebalance' _types.analysis.PersianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - persian_stem required: - type _types.aggregations.MatrixStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MatrixAggregation' - type: object properties: mode: description: Array value the aggregation will use for array or multi-valued fields. default: avg allOf: - $ref: '#/components/schemas/_types.SortMode' _types.aggregations.TTestAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: a: description: Test population A. allOf: - $ref: '#/components/schemas/_types.aggregations.TestPopulation' b: description: Test population B. allOf: - $ref: '#/components/schemas/_types.aggregations.TestPopulation' type: description: The type of test. default: heteroscedastic allOf: - $ref: '#/components/schemas/_types.aggregations.TTestType' _types.aggregations.ScriptedHeuristic: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.IBDistribution: type: string enum: - ll - spl _types.mapping.RuntimeFieldFetchFields: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' format: type: string required: - field _types.aggregations.FrequentItemSetsAggregation: type: object properties: fields: description: Fields to analyze. type: array items: $ref: '#/components/schemas/_types.aggregations.FrequentItemSetsField' minimum_set_size: description: The minimum size of one item set. default: 1.0 type: number minimum_support: description: The minimum support of one item set. default: 0.1 type: number size: description: The number of top item sets to return. default: 10.0 type: number filter: description: Query that filters documents from analysis. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - fields security.delete_privileges.FoundStatus: type: object properties: found: type: boolean required: - found _types.aggregations.FiltersAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: filters: description: Collection of queries from which to build buckets. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsQueryContainer' other_bucket: description: Set to `true` to add a bucket to the response which will contain all documents that do not match any of the given filters. type: boolean other_bucket_key: description: The key with which the other bucket is returned. default: _other_ type: string keyed: description: 'By default, the named filters aggregation returns the buckets as an object. Set to `false` to return the buckets as an array of objects.' default: true type: boolean _types.query_dsl.IntervalsAnyOf: type: object properties: intervals: description: An array of rules to match. type: array items: $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' filter: description: Rule used to filter returned intervals. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - intervals _types.aggregations.PValueHeuristic: type: object properties: background_is_superset: type: boolean normalize_above: description: 'Should the results be normalized when above the given value. Allows for consistent significance results at various scales. Note: `0` is a special value which means no normalization' default: 0.0 type: number _types.aggregations.BucketCorrelationAggregation: description: A sibling pipeline aggregation which executes a correlation function on the configured sibling multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: function: description: The correlation function to execute. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunction' required: - function _types.analysis.DecimalDigitTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - decimal_digit required: - type _types.GeoTile: description: A map tile reference, represented as `{zoom}/{x}/{y}` type: string indices._types.SlowlogSettings: type: object properties: level: type: string source: type: number reformat: type: boolean threshold: allOf: - $ref: '#/components/schemas/indices._types.SlowlogTresholds' _types.analysis.TokenFilterDefinition: discriminator: propertyName: type mapping: apostrophe: '#/components/schemas/_types.analysis.ApostropheTokenFilter' arabic_normalization: '#/components/schemas/_types.analysis.ArabicNormalizationTokenFilter' arabic_stem: '#/components/schemas/_types.analysis.ArabicStemTokenFilter' asciifolding: '#/components/schemas/_types.analysis.AsciiFoldingTokenFilter' bengali_normalization: '#/components/schemas/_types.analysis.BengaliNormalizationTokenFilter' brazilian_stem: '#/components/schemas/_types.analysis.BrazilianStemTokenFilter' cjk_bigram: '#/components/schemas/_types.analysis.CjkBigramTokenFilter' cjk_width: '#/components/schemas/_types.analysis.CjkWidthTokenFilter' classic: '#/components/schemas/_types.analysis.ClassicTokenFilter' common_grams: '#/components/schemas/_types.analysis.CommonGramsTokenFilter' condition: '#/components/schemas/_types.analysis.ConditionTokenFilter' czech_stem: '#/components/schemas/_types.analysis.CzechStemTokenFilter' decimal_digit: '#/components/schemas/_types.analysis.DecimalDigitTokenFilter' delimited_payload: '#/components/schemas/_types.analysis.DelimitedPayloadTokenFilter' dictionary_decompounder: '#/components/schemas/_types.analysis.DictionaryDecompounderTokenFilter' dutch_stem: '#/components/schemas/_types.analysis.DutchStemTokenFilter' edge_ngram: '#/components/schemas/_types.analysis.EdgeNGramTokenFilter' elision: '#/components/schemas/_types.analysis.ElisionTokenFilter' fingerprint: '#/components/schemas/_types.analysis.FingerprintTokenFilter' flatten_graph: '#/components/schemas/_types.analysis.FlattenGraphTokenFilter' french_stem: '#/components/schemas/_types.analysis.FrenchStemTokenFilter' german_normalization: '#/components/schemas/_types.analysis.GermanNormalizationTokenFilter' german_stem: '#/components/schemas/_types.analysis.GermanStemTokenFilter' hindi_normalization: '#/components/schemas/_types.analysis.HindiNormalizationTokenFilter' hunspell: '#/components/schemas/_types.analysis.HunspellTokenFilter' hyphenation_decompounder: '#/components/schemas/_types.analysis.HyphenationDecompounderTokenFilter' icu_collation: '#/components/schemas/_types.analysis.IcuCollationTokenFilter' icu_folding: '#/components/schemas/_types.analysis.IcuFoldingTokenFilter' icu_normalizer: '#/components/schemas/_types.analysis.IcuNormalizationTokenFilter' icu_transform: '#/components/schemas/_types.analysis.IcuTransformTokenFilter' indic_normalization: '#/components/schemas/_types.analysis.IndicNormalizationTokenFilter' ja_stop: '#/components/schemas/_types.analysis.JaStopTokenFilter' keep: '#/components/schemas/_types.analysis.KeepWordsTokenFilter' keep_types: '#/components/schemas/_types.analysis.KeepTypesTokenFilter' keyword_marker: '#/components/schemas/_types.analysis.KeywordMarkerTokenFilter' keyword_repeat: '#/components/schemas/_types.analysis.KeywordRepeatTokenFilter' kstem: '#/components/schemas/_types.analysis.KStemTokenFilter' kuromoji_part_of_speech: '#/components/schemas/_types.analysis.KuromojiPartOfSpeechTokenFilter' kuromoji_readingform: '#/components/schemas/_types.analysis.KuromojiReadingFormTokenFilter' kuromoji_stemmer: '#/components/schemas/_types.analysis.KuromojiStemmerTokenFilter' length: '#/components/schemas/_types.analysis.LengthTokenFilter' limit: '#/components/schemas/_types.analysis.LimitTokenCountTokenFilter' lowercase: '#/components/schemas/_types.analysis.LowercaseTokenFilter' min_hash: '#/components/schemas/_types.analysis.MinHashTokenFilter' multiplexer: '#/components/schemas/_types.analysis.MultiplexerTokenFilter' ngram: '#/components/schemas/_types.analysis.NGramTokenFilter' nori_part_of_speech: '#/components/schemas/_types.analysis.NoriPartOfSpeechTokenFilter' pattern_capture: '#/components/schemas/_types.analysis.PatternCaptureTokenFilter' pattern_replace: '#/components/schemas/_types.analysis.PatternReplaceTokenFilter' persian_normalization: '#/components/schemas/_types.analysis.PersianNormalizationTokenFilter' persian_stem: '#/components/schemas/_types.analysis.PersianStemTokenFilter' phonetic: '#/components/schemas/_types.analysis.PhoneticTokenFilter' porter_stem: '#/components/schemas/_types.analysis.PorterStemTokenFilter' predicate_token_filter: '#/components/schemas/_types.analysis.PredicateTokenFilter' remove_duplicates: '#/components/schemas/_types.analysis.RemoveDuplicatesTokenFilter' reverse: '#/components/schemas/_types.analysis.ReverseTokenFilter' russian_stem: '#/components/schemas/_types.analysis.RussianStemTokenFilter' scandinavian_folding: '#/components/schemas/_types.analysis.ScandinavianFoldingTokenFilter' scandinavian_normalization: '#/components/schemas/_types.analysis.ScandinavianNormalizationTokenFilter' serbian_normalization: '#/components/schemas/_types.analysis.SerbianNormalizationTokenFilter' shingle: '#/components/schemas/_types.analysis.ShingleTokenFilter' snowball: '#/components/schemas/_types.analysis.SnowballTokenFilter' sorani_normalization: '#/components/schemas/_types.analysis.SoraniNormalizationTokenFilter' stemmer: '#/components/schemas/_types.analysis.StemmerTokenFilter' stemmer_override: '#/components/schemas/_types.analysis.StemmerOverrideTokenFilter' stop: '#/components/schemas/_types.analysis.StopTokenFilter' synonym: '#/components/schemas/_types.analysis.SynonymTokenFilter' synonym_graph: '#/components/schemas/_types.analysis.SynonymGraphTokenFilter' trim: '#/components/schemas/_types.analysis.TrimTokenFilter' truncate: '#/components/schemas/_types.analysis.TruncateTokenFilter' unique: '#/components/schemas/_types.analysis.UniqueTokenFilter' uppercase: '#/components/schemas/_types.analysis.UppercaseTokenFilter' word_delimiter: '#/components/schemas/_types.analysis.WordDelimiterTokenFilter' word_delimiter_graph: '#/components/schemas/_types.analysis.WordDelimiterGraphTokenFilter' oneOf: - $ref: '#/components/schemas/_types.analysis.ApostropheTokenFilter' - $ref: '#/components/schemas/_types.analysis.ArabicStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.ArabicNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.AsciiFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.BengaliNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.BrazilianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.CjkBigramTokenFilter' - $ref: '#/components/schemas/_types.analysis.CjkWidthTokenFilter' - $ref: '#/components/schemas/_types.analysis.ClassicTokenFilter' - $ref: '#/components/schemas/_types.analysis.CommonGramsTokenFilter' - $ref: '#/components/schemas/_types.analysis.ConditionTokenFilter' - $ref: '#/components/schemas/_types.analysis.CzechStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.DecimalDigitTokenFilter' - $ref: '#/components/schemas/_types.analysis.DelimitedPayloadTokenFilter' - $ref: '#/components/schemas/_types.analysis.DutchStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.EdgeNGramTokenFilter' - $ref: '#/components/schemas/_types.analysis.ElisionTokenFilter' - $ref: '#/components/schemas/_types.analysis.FingerprintTokenFilter' - $ref: '#/components/schemas/_types.analysis.FlattenGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.FrenchStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.GermanNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.GermanStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.HindiNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.HunspellTokenFilter' - $ref: '#/components/schemas/_types.analysis.HyphenationDecompounderTokenFilter' - $ref: '#/components/schemas/_types.analysis.IndicNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeepTypesTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeepWordsTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeywordMarkerTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeywordRepeatTokenFilter' - $ref: '#/components/schemas/_types.analysis.KStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.LengthTokenFilter' - $ref: '#/components/schemas/_types.analysis.LimitTokenCountTokenFilter' - $ref: '#/components/schemas/_types.analysis.LowercaseTokenFilter' - $ref: '#/components/schemas/_types.analysis.MinHashTokenFilter' - $ref: '#/components/schemas/_types.analysis.MultiplexerTokenFilter' - $ref: '#/components/schemas/_types.analysis.NGramTokenFilter' - $ref: '#/components/schemas/_types.analysis.NoriPartOfSpeechTokenFilter' - $ref: '#/components/schemas/_types.analysis.PatternCaptureTokenFilter' - $ref: '#/components/schemas/_types.analysis.PatternReplaceTokenFilter' - $ref: '#/components/schemas/_types.analysis.PersianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.PersianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.PorterStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.PredicateTokenFilter' - $ref: '#/components/schemas/_types.analysis.RemoveDuplicatesTokenFilter' - $ref: '#/components/schemas/_types.analysis.ReverseTokenFilter' - $ref: '#/components/schemas/_types.analysis.RussianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.ScandinavianFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.ScandinavianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.SerbianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.ShingleTokenFilter' - $ref: '#/components/schemas/_types.analysis.SnowballTokenFilter' - $ref: '#/components/schemas/_types.analysis.SoraniNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.StemmerOverrideTokenFilter' - $ref: '#/components/schemas/_types.analysis.StemmerTokenFilter' - $ref: '#/components/schemas/_types.analysis.StopTokenFilter' - $ref: '#/components/schemas/_types.analysis.SynonymGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilter' - $ref: '#/components/schemas/_types.analysis.TrimTokenFilter' - $ref: '#/components/schemas/_types.analysis.TruncateTokenFilter' - $ref: '#/components/schemas/_types.analysis.UniqueTokenFilter' - $ref: '#/components/schemas/_types.analysis.UppercaseTokenFilter' - $ref: '#/components/schemas/_types.analysis.WordDelimiterGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilter' - $ref: '#/components/schemas/_types.analysis.JaStopTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiStemmerTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiReadingFormTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiPartOfSpeechTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuCollationTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuTransformTokenFilter' - $ref: '#/components/schemas/_types.analysis.PhoneticTokenFilter' - $ref: '#/components/schemas/_types.analysis.DictionaryDecompounderTokenFilter' _types.analysis.ArmenianAnalyzer: type: object properties: type: type: string enum: - armenian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _global.search._types.HighlighterType: anyOf: - type: string enum: - plain - fvh - unified - type: string security._types.IndicesPrivilegesQuery: description: 'While creating or updating a role you can provide either a JSON structure or a string to the API. However, the response provided by Elasticsearch will only be string with a json-as-text content. Since this is embedded in `IndicesPrivileges`, the same structure is used for clarity in both contexts.' oneOf: - type: string - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - $ref: '#/components/schemas/security._types.RoleTemplateQuery' security._types.GrantType: type: string enum: - password - access_token _types.WktGeoBounds: type: object properties: wkt: type: string required: - wkt _types.aggregations.ChangePointAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.mapping.RuntimeFieldType: type: string enum: - boolean - composite - date - double - geo_point - geo_shape - ip - keyword - long - lookup _types.query_dsl.CombinedFieldsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: fields: description: List of fields to search. Field wildcard patterns are allowed. Only `text` fields are supported, and they must all have the same search `analyzer`. type: array items: $ref: '#/components/schemas/_types.Field' query: description: 'Text to search for in the provided `fields`. The `combined_fields` query analyzes the provided text before performing a search.' type: string auto_generate_synonyms_phrase_query: description: If true, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean operator: description: Boolean logic used to interpret text in the query value. default: or allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsOperator' minimum_should_match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-minimum-should-match description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' zero_terms_query: description: Indicates whether no documents are returned if the analyzer removes all tokens, such as when using a `stop` filter. default: none allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsZeroTerms' required: - fields - query security._types.SearchAccess: type: object properties: field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. allOf: - $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' query: description: A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role. allOf: - $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. default: false type: boolean required: - names _types.TextEmbedding: type: object properties: model_id: description: 'Model ID is required for all dense_vector fields but may be inferred for semantic_text fields' x-state: Generally available; Added in 8.18.0 type: string model_text: description: The text to be converted into a vector by the specified model type: string required: - model_text indices._types.IndexSettingsAnalysis: type: object properties: analyzer: type: object additionalProperties: $ref: '#/components/schemas/_types.analysis.Analyzer' char_filter: type: object additionalProperties: $ref: '#/components/schemas/_types.analysis.CharFilter' filter: type: object additionalProperties: $ref: '#/components/schemas/_types.analysis.TokenFilter' normalizer: type: object additionalProperties: $ref: '#/components/schemas/_types.analysis.Normalizer' tokenizer: type: object additionalProperties: $ref: '#/components/schemas/_types.analysis.Tokenizer' _types.aggregations.DateRangeAggregate: description: 'Result of a `date_range` aggregation. Same format as a for a `range` aggregation: `from` and `to` in `buckets` are milliseconds since the Epoch, represented as a floating point number.' allOf: - $ref: '#/components/schemas/_types.aggregations.RangeAggregate' - type: object _types.aggregations.LongTermsAggregate: description: Result of a `terms` aggregation when the field is some kind of whole number like a integer, long, or a date. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregateBaseLongTermsBucket' - type: object _types.analysis.KuromojiReadingFormTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_readingform use_romaji: type: boolean required: - type - use_romaji _types.analysis.Normalizer: discriminator: propertyName: type mapping: custom: '#/components/schemas/_types.analysis.CustomNormalizer' lowercase: '#/components/schemas/_types.analysis.LowercaseNormalizer' oneOf: - $ref: '#/components/schemas/_types.analysis.LowercaseNormalizer' - $ref: '#/components/schemas/_types.analysis.CustomNormalizer' indices._types.IndexingSlowlogSettings: type: object properties: level: type: string source: type: number reformat: type: boolean threshold: allOf: - $ref: '#/components/schemas/indices._types.IndexingSlowlogTresholds' security.get_service_credentials.NodesCredentials: type: object properties: _nodes: description: General status showing how nodes respond to the above collection request allOf: - $ref: '#/components/schemas/_types.NodeStatistics' file_tokens: description: File-backed tokens collected from all nodes type: object additionalProperties: $ref: '#/components/schemas/security.get_service_credentials.NodesCredentialsFileToken' required: - _nodes - file_tokens _types.RescorerRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: Inner retriever. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rescore: oneOf: - $ref: '#/components/schemas/_global.search._types.Rescore' - type: array items: $ref: '#/components/schemas/_global.search._types.Rescore' required: - retriever - rescore _types.query_dsl.DistanceFeatureQuery: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-distance-feature-query oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedDistanceFeatureQuery' - $ref: '#/components/schemas/_types.query_dsl.GeoDistanceFeatureQuery' - $ref: '#/components/schemas/_types.query_dsl.DateDistanceFeatureQuery' _types.analysis.ConditionTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - condition filter: description: Array of token filters. If a token matches the predicate script in the `script` parameter, these filters are applied to the token in the order provided. type: array items: type: string script: description: Predicate script used to apply token filters. If a token matches this script, the filters in the `filter` parameter are applied to the token. allOf: - $ref: '#/components/schemas/_types.Script' required: - type - filter - script _types.analysis.WhitespaceAnalyzer: type: object properties: type: type: string enum: - whitespace version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' required: - type _types.aggregations.CartesianBoundsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object _types.GeoBounds: description: 'A geo bounding box. It can be represented in various ways: - as 4 top/bottom/left/right coordinates - as 2 top_left / bottom_right points - as 2 top_right / bottom_left points - as a WKT bounding box' oneOf: - $ref: '#/components/schemas/_types.CoordsGeoBounds' - $ref: '#/components/schemas/_types.TopLeftBottomRightGeoBounds' - $ref: '#/components/schemas/_types.TopRightBottomLeftGeoBounds' - $ref: '#/components/schemas/_types.WktGeoBounds' _global.search._types.SearchRequestBody: type: object properties: aggregations: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/aggregations description: Defines the aggregations that are run as part of the search request. type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' collapse: description: Collapses search results the values of the specified field. allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' explain: description: If `true`, the request returns detailed information about score computation as part of a hit. default: false type: boolean ext: description: Configuration of search extensions defined by Elasticsearch plugins. type: object additionalProperties: type: object from: description: 'The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 0.0 type: number highlight: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/highlighting description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results. allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' track_total_hits: description: 'Number of hits matching the query to count accurately. If `true`, the exact number of hits is returned at the cost of some performance. If `false`, the response does not include the total number of hits matching the query.' default: '10000' allOf: - $ref: '#/components/schemas/_global.search._types.TrackHits' indices_boost: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl#relevance-scores description: 'Boost the `_score` of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than `1.0` increases the score. A boost value between `0` and `1.0` decreases the score.' type: array items: type: object additionalProperties: type: number minProperties: 1 maxProperties: 1 docvalue_fields: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#docvalue-fields description: 'An array of wildcard (`*`) field patterns. The request returns doc values for field names matching these patterns in the `hits.fields` property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' knn: externalDocs: url: https://www.elastic.co/docs/solutions/search/vector/knn#approximate-knn description: The approximate kNN search to run. x-state: Generally available; Added in 8.4.0 oneOf: - $ref: '#/components/schemas/_types.KnnSearch' - type: array items: $ref: '#/components/schemas/_types.KnnSearch' rank: description: The Reciprocal Rank Fusion (RRF) to use. x-state: Generally available; Added in 8.8.0 allOf: - $ref: '#/components/schemas/_types.RankContainer' min_score: description: 'The minimum `_score` for matching documents. Documents with a lower `_score` are not included in search results or results collected by aggregations.' type: number post_filter: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/filter-search-results description: 'Use the `post_filter` parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' profile: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/search-profile description: 'Set to `true` to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.' default: false type: boolean query: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl description: The search definition using the Query DSL. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' rescore: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/rescore-search-results description: Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the `query` and `post_filter` phases. oneOf: - $ref: '#/components/schemas/_global.search._types.Rescore' - type: array items: $ref: '#/components/schemas/_global.search._types.Rescore' retriever: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrievers description: 'A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as `query` and `knn`.' x-state: Generally available; Added in 8.14.0 allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' script_fields: description: Retrieve a script evaluation (based on different fields) for each hit. type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' search_after: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/paginate-search-results#search-after description: Used to retrieve the next page of hits using a set of sort values from the previous page. allOf: - $ref: '#/components/schemas/_types.SortResults' size: description: 'The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` property.' default: 10.0 type: number slice: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/paginate-search-results#slice-scroll description: Split a scrolled search into multiple slices that can be consumed independently. allOf: - $ref: '#/components/schemas/_types.SlicedScroll' sort: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/sort-search-results description: A comma-separated list of : pairs. allOf: - $ref: '#/components/schemas/_types.Sort' _source: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#source-filtering description: 'The source fields that are returned for matching documents. These fields are returned in the `hits._source` property of the search response. If the `stored_fields` property is specified, the `_source` property defaults to `false`. Otherwise, it defaults to `true`.' allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' fields: description: 'An array of wildcard (`*`) field patterns. The request returns values for field names matching these patterns in the `hits.fields` property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' suggest: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/search-suggesters description: Defines a suggester that provides similar looking terms based on a provided text. allOf: - $ref: '#/components/schemas/_global.search._types.Suggester' terminate_after: description: 'The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers. If set to `0` (default), the query does not terminate early.' default: 0.0 type: number timeout: description: 'The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.' type: string track_scores: description: If `true`, calculate and return document scores, even if the scores are not used for sorting. default: false type: boolean version: description: If `true`, the request returns the document version as part of a hit. default: false type: boolean seq_no_primary_term: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/optimistic-concurrency-control description: If `true`, the request returns sequence number and primary term of the last modification of each hit. type: boolean stored_fields: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#stored-fields description: 'A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the `_source` property defaults to `false`. You can pass `_source: true` to return both source fields and stored fields in the search response.' allOf: - $ref: '#/components/schemas/_types.Fields' pit: description: 'Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an `` in the request path.' allOf: - $ref: '#/components/schemas/_global.search._types.PointInTimeReference' runtime_mappings: externalDocs: url: https://www.elastic.co/docs/manage-data/data-store/mapping/define-runtime-fields-in-search-request description: 'One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.' allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' stats: description: 'The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.' type: array items: type: string _types.analysis.HungarianAnalyzer: type: object properties: type: type: string enum: - hungarian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type security._types.BulkError: type: object properties: count: description: The number of errors type: number details: description: Details about the errors, keyed by role name type: object additionalProperties: $ref: '#/components/schemas/_types.ErrorCause' required: - count - details _types.analysis.IcuCollationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_collation alternate: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationAlternate' caseFirst: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationCaseFirst' caseLevel: type: boolean country: type: string decomposition: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationDecomposition' hiraganaQuaternaryMode: type: boolean language: type: string numeric: type: boolean rules: type: string strength: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationStrength' variableTop: type: string variant: type: string required: - type _types.aggregations.FiltersAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseFiltersBucket' - type: object _types.TopLeftBottomRightGeoBounds: type: object properties: top_left: allOf: - $ref: '#/components/schemas/_types.GeoLocation' bottom_right: allOf: - $ref: '#/components/schemas/_types.GeoLocation' required: - top_left - bottom_right _types.query_dsl.IntervalsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-intervals-query type: object properties: all_of: description: Returns matches that span a combination of other rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAllOf' any_of: description: Returns intervals produced by any of its sub-rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAnyOf' fuzzy: description: Matches terms that are similar to the provided term, within an edit distance defined by `fuzziness`. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFuzzy' match: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsMatch' prefix: description: Matches terms that start with a specified set of characters. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsPrefix' range: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRange' regexp: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRegexp' wildcard: description: Matches terms using a wildcard pattern. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsWildcard' minProperties: 1 maxProperties: 1 _types.NestedSortValue: type: object properties: filter: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' max_children: type: number nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' path: allOf: - $ref: '#/components/schemas/_types.Field' required: - path _types.query_dsl.RankFeatureFunction: type: object _global.search._types.SourceFilter: type: object properties: exclude_vectors: description: 'If `true`, vector fields are excluded from the returned source. This option takes precedence over `includes`: any vector field will remain excluded even if it matches an `includes` rule.' type: boolean excludes: description: A list of fields to exclude from the returned source. allOf: - $ref: '#/components/schemas/_types.Fields' includes: description: A list of fields to include in the returned source. allOf: - $ref: '#/components/schemas/_types.Fields' security.get_role.IndicesPrivilegesRead: description: 'Read-side variant of `IndicesPrivileges` returned by the get role API. Carries the `implicitly_granted` marker that is set on entries contributed by a registered `ImplicitPrivilegesProvider` when `include_implicit` is `true`.' type: object properties: implicitly_granted: description: 'Set to `true` on entries that were contributed by a registered `ImplicitPrivilegesProvider` rather than explicitly stored on the role. Only present when the get role API is called with `include_implicit=true`. The put role API rejects this field, so clients must not echo it back on a GET-then-PUT round-trip.' x-state: Generally available; Added in 9.5.0 type: boolean field_security: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level description: The document fields that the owners of the role have read access to. allOf: - $ref: '#/components/schemas/security._types.FieldSecurity' names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' privileges: description: The index level privileges that owners of the role have on the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' query: description: A search query that defines the documents the owners of the role have access to. A document within the specified indices must match this query for it to be accessible by the owners of the role. allOf: - $ref: '#/components/schemas/security._types.IndicesPrivilegesQuery' allow_restricted_indices: description: Set to `true` if using wildcard or regular expressions for patterns that cover restricted indices. Implicitly, restricted indices have limited privileges that can cause pattern tests to fail. If restricted indices are explicitly included in the `names` list, Elasticsearch checks privileges against these indices regardless of the value set for `allow_restricted_indices`. default: false type: boolean required: - names - privileges _types.QueryVectorBuilder: type: object properties: embedding: allOf: - $ref: '#/components/schemas/_types.Embedding' text_embedding: allOf: - $ref: '#/components/schemas/_types.TextEmbedding' lookup: description: 'Lookup a vector from an existing document. Must reference a dense_vector field and a single value.' x-state: Generally available; Added in 9.4.0 allOf: - $ref: '#/components/schemas/_types.LookupQueryVectorBuilder' minProperties: 1 maxProperties: 1 _types.query_dsl.SpanNotQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: dist: description: 'The number of tokens from within the include span that can’t have overlap with the exclude span. Equivalent to setting both `pre` and `post`.' type: number exclude: description: Span query whose matches must not overlap those returned. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' include: description: Span query whose matches are filtered. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' post: description: The number of tokens after the include span that can’t have overlap with the exclude span. default: 0.0 type: number pre: description: The number of tokens before the include span that can’t have overlap with the exclude span. default: 0.0 type: number required: - exclude - include _types.analysis.NoriTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - nori_tokenizer decompound_mode: allOf: - $ref: '#/components/schemas/_types.analysis.NoriDecompoundMode' discard_punctuation: type: boolean user_dictionary: type: string user_dictionary_rules: type: array items: type: string required: - type _types.analysis.IcuNormalizationType: type: string enum: - nfc - nfkc - nfkc_cf security.enroll_kibana.Token: type: object properties: name: description: The name of the bearer token for the `elastic/kibana` service account. type: string value: description: 'The value of the bearer token for the `elastic/kibana` service account. Use this value to authenticate the service account with Elasticsearch.' type: string required: - name - value indices._types.IndexRoutingRebalance: type: object properties: enable: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingRebalanceOptions' required: - enable _types.aggregations.MovingAverageAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: minimize: type: boolean predict: type: number window: type: number _types.Ids: oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' _types.query_dsl.RegexpQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: case_insensitive: description: 'Allows case insensitive matching of the regular expression value with the indexed field values when set to `true`. When `false`, case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean flags: description: Enables optional operators for the regular expression. type: string max_determinized_states: description: Maximum number of automaton states required for the query. default: 10000.0 type: number rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Regular expression for terms you wish to find in the provided field. type: string required: - value _types.aggregations.FieldDateMath: description: 'A date range limit, represented either as a DateMath expression or a number expressed according to the target field''s precision.' oneOf: - $ref: '#/components/schemas/_types.DateMath' - type: number _types.DiversifyRetrieverTypes: type: string enum: - mmr _types.Metadata: type: object additionalProperties: type: object _types.analysis.FingerprintAnalyzer: type: object properties: type: type: string enum: - fingerprint version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' max_output_size: description: 'The maximum token size to emit. Tokens larger than this size will be discarded. Defaults to `255`' default: 255.0 type: number separator: description: 'The character to use to concatenate the terms. Defaults to a space.' type: string stopwords: description: 'A pre-defined stop words list like `_english_` or an array containing a list of stop words. Defaults to `_none_`.' default: _none_ allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: The path to a file containing stop words. type: string required: - type _types.aggregations.AverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.GeoDistanceType: type: string enum: - arc - plane _types.TokenPruningConfig: type: object properties: tokens_freq_ratio_threshold: description: Tokens whose frequency is more than this threshold times the average frequency of all tokens in the specified field are considered outliers and pruned. default: 5.0 type: number tokens_weight_threshold: description: Tokens whose weight is less than this threshold are considered nonsignificant and pruned. default: 0.4 type: number only_score_pruned_tokens: description: Whether to only score pruned tokens, vs only scoring kept tokens. default: false type: boolean _types.TopRightBottomLeftGeoBounds: type: object properties: top_right: allOf: - $ref: '#/components/schemas/_types.GeoLocation' bottom_left: allOf: - $ref: '#/components/schemas/_types.GeoLocation' required: - top_right - bottom_left indices._types.SettingsSimilarityLmj: type: object properties: type: type: string enum: - LMJelinekMercer lambda: type: number required: - type _types.query_dsl.QueryBase: type: object properties: boost: description: 'Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.' default: 1.0 type: number _name: type: string _types.analysis.PhoneticLanguage: type: string enum: - any - common - cyrillic - english - french - german - hebrew - hungarian - polish - romanian - russian - spanish _types.query_dsl.PercolateQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: document: description: The source of the document being percolated. type: object documents: description: An array of sources of the documents being percolated. type: array items: type: object field: description: Field that holds the indexed queries. The field must use the `percolator` mapping type. allOf: - $ref: '#/components/schemas/_types.Field' id: description: The ID of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.Id' index: description: The index of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.IndexName' name: description: The suffix used for the `_percolator_document_slot` field when multiple `percolate` queries are specified. type: string preference: description: Preference used to fetch document to percolate. type: string routing: description: Routing used to fetch document to percolate. type: string version: description: The expected version of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.VersionNumber' required: - field _types.query_dsl.IntervalsWildcard: type: object properties: analyzer: description: 'Analyzer used to analyze the `pattern`. Defaults to the top-level field''s analyzer.' type: string pattern: description: Wildcard pattern used to find matching terms. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `pattern` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - pattern _types.aggregations.TermsExclude: oneOf: - type: string - type: array items: type: string _types.SequenceNumber: type: number _types.query_dsl.WrapperQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: query: description: 'A base64 encoded query. The binary data format can be any of JSON, YAML, CBOR or SMILE encodings' type: string required: - query _types.query_dsl.FieldValueFactorScoreFunction: type: object properties: field: description: Field to be extracted from the document. allOf: - $ref: '#/components/schemas/_types.Field' factor: description: Optional factor to multiply the field value with. default: 1.0 type: number missing: description: 'Value used if the document doesn’t have that field. The modifier and factor are still applied to it as though it were read from the document.' type: number modifier: description: Modifier to apply to the field value. allOf: - $ref: '#/components/schemas/_types.query_dsl.FieldValueFactorModifier' required: - field _types.analysis.PatternTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - pattern flags: type: string group: type: number pattern: type: string required: - type _types.aggregations.TermsAggregationExecutionHint: type: string enum: - map - global_ordinals - global_ordinals_hash - global_ordinals_low_cardinality security._types.RoleMapping: type: object properties: enabled: type: boolean metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' roles: type: array items: type: string role_templates: type: array items: $ref: '#/components/schemas/security._types.RoleTemplate' rules: allOf: - $ref: '#/components/schemas/security._types.RoleMappingRule' required: - enabled - metadata - rules _types.analysis.NoriPartOfSpeechTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - nori_part_of_speech stoptags: description: An array of part-of-speech tags that should be removed. type: array items: type: string required: - type _types.analysis.RomanianAnalyzer: type: object properties: type: type: string enum: - romanian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.analysis.CzechAnalyzer: type: object properties: type: type: string enum: - czech stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.BucketsRangeBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.RangeBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.RangeBucket' _types.analysis.TokenizerBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.aggregations.SerialDifferencingAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: lag: description: 'The historical bucket to subtract from the current value. Must be a positive, non-zero integer.' type: number _types.query_dsl.QueryContainer: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl description: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query. type: object properties: bool: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-bool-query description: matches documents matching boolean combinations of other queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoolQuery' boosting: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-boosting-query description: Returns documents matching a `positive` query while reducing the relevance score of documents that also match a `negative` query. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoostingQuery' common: deprecated: true type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.CommonTermsQuery' minProperties: 1 maxProperties: 1 combined_fields: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-combined-fields-query description: The `combined_fields` query supports searching multiple text fields as if their contents had been indexed into one combined field. x-state: Generally available; Added in 7.13.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsQuery' constant_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-constant-score-query description: Wraps a filter query and returns every matching document with a relevance score equal to the `boost` parameter value. allOf: - $ref: '#/components/schemas/_types.query_dsl.ConstantScoreQuery' dis_max: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-dis-max-query description: 'Returns documents matching one or more wrapped queries, called query clauses or clauses. If a returned document matches multiple query clauses, the `dis_max` query assigns the document the highest relevance score from any matching clause, plus a tie breaking increment for any additional matching subqueries.' allOf: - $ref: '#/components/schemas/_types.query_dsl.DisMaxQuery' distance_feature: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-distance-feature-query description: 'Boosts the relevance score of documents closer to a provided origin date or point. For example, you can use this query to give more weight to documents closer to a certain date or location.' allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQuery' exists: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-exists-query description: Returns documents that contain an indexed value for a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.ExistsQuery' function_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-function-score-query description: The `function_score` enables you to modify the score of documents that are retrieved by a query. allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionScoreQuery' fuzzy: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-fuzzy-query description: Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.FuzzyQuery' minProperties: 1 maxProperties: 1 geo_bounding_box: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-bounding-box-query description: Matches geo_point and geo_shape values that intersect a bounding box. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoBoundingBoxQuery' geo_distance: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-distance-query description: Matches `geo_point` and `geo_shape` values within a given distance of a geopoint. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoDistanceQuery' geo_grid: description: Matches `geo_point` and `geo_shape` values that intersect a grid cell from a GeoGrid aggregation. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.GeoGridQuery' minProperties: 1 maxProperties: 1 geo_polygon: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoPolygonQuery' geo_shape: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-shape-query description: Filter documents indexed using either the `geo_shape` or the `geo_point` type. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoShapeQuery' has_child: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-has-child-query description: Returns parent documents whose joined child documents match a provided query. allOf: - $ref: '#/components/schemas/_types.query_dsl.HasChildQuery' has_parent: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-has-parent-query description: Returns child documents whose joined parent document matches a provided query. allOf: - $ref: '#/components/schemas/_types.query_dsl.HasParentQuery' ids: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-ids-query description: 'Returns documents based on their IDs. This query uses document IDs stored in the `_id` field.' allOf: - $ref: '#/components/schemas/_types.query_dsl.IdsQuery' intervals: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-intervals-query description: Returns documents based on the order and proximity of matching terms. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.IntervalsQuery' minProperties: 1 maxProperties: 1 knn: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-knn-query description: 'Finds the k nearest vectors to a query vector, as measured by a similarity metric. knn query finds nearest vectors through approximate search on indexed dense_vectors.' allOf: - $ref: '#/components/schemas/_types.KnnQuery' match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query description: 'Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchQuery' minProperties: 1 maxProperties: 1 match_all: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-all-query description: Matches all documents, giving them all a `_score` of 1.0. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchAllQuery' match_bool_prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-bool-prefix-query description: 'Analyzes its input and constructs a `bool` query from the terms. Each term except the last is used in a `term` query. The last term is used in a prefix query.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchBoolPrefixQuery' minProperties: 1 maxProperties: 1 match_none: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-all-query#query-dsl-match-none-query description: Matches no documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchNoneQuery' match_phrase: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query-phrase description: Analyzes the text and creates a phrase query out of the analyzed text. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchPhraseQuery' minProperties: 1 maxProperties: 1 match_phrase_prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query-phrase-prefix description: 'Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchPhrasePrefixQuery' minProperties: 1 maxProperties: 1 more_like_this: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-mlt-query description: Returns documents that are "like" a given set of documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.MoreLikeThisQuery' multi_match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-multi-match-query description: 'Enables you to search for a provided text, number, date or boolean value across multiple fields. The provided text is analyzed before matching.' allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiMatchQuery' nested: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-nested-query description: 'Wraps another query to search nested fields. If an object matches the search, the nested query returns the root parent document.' allOf: - $ref: '#/components/schemas/_types.query_dsl.NestedQuery' parent_id: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-parent-id-query description: Returns child documents joined to a specific parent document. allOf: - $ref: '#/components/schemas/_types.query_dsl.ParentIdQuery' percolate: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-percolate-query description: Matches queries stored in an index. allOf: - $ref: '#/components/schemas/_types.query_dsl.PercolateQuery' pinned: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-pinned-query description: Promotes selected documents to rank higher than those matching a given query. allOf: - $ref: '#/components/schemas/_types.query_dsl.PinnedQuery' prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-prefix-query description: Returns documents that contain a specific prefix in a provided field. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.PrefixQuery' minProperties: 1 maxProperties: 1 query_string: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-query-string-query description: Returns documents based on a provided query string, using a parser with a strict syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryStringQuery' range: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-range-query description: Returns documents that contain terms within a provided range. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RangeQuery' minProperties: 1 maxProperties: 1 rank_feature: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-rank-feature-query description: Boosts the relevance score of documents based on the numeric value of a `rank_feature` or `rank_features` field. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureQuery' regexp: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-regexp-query description: Returns documents that contain terms matching a regular expression. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RegexpQuery' minProperties: 1 maxProperties: 1 rule: allOf: - $ref: '#/components/schemas/_types.query_dsl.RuleQuery' script: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-script-query description: 'Filters documents based on a provided script. The script query is typically used in a filter context.' allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptQuery' script_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-script-score-query description: Uses a script to provide a custom score for returned documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptScoreQuery' semantic: description: A semantic query to semantic_text field types x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.SemanticQuery' shape: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-shape-query description: Queries documents that contain fields indexed using the `shape` type. allOf: - $ref: '#/components/schemas/_types.query_dsl.ShapeQuery' simple_query_string: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query description: Returns documents based on a provided query string, using a parser with a limited but fault-tolerant syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringQuery' span_containing: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-containing-query description: Returns matches which enclose another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanContainingQuery' span_field_masking: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-field-masking-query description: Wrapper to allow span queries to participate in composite single-field span queries by _lying_ about their search field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFieldMaskingQuery' span_first: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-first-query description: Matches spans near the beginning of a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFirstQuery' span_multi: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-multi-term-query description: Allows you to wrap a multi term query (one of `wildcard`, `fuzzy`, `prefix`, `range`, or `regexp` query) as a `span` query, so it can be nested. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanMultiTermQuery' span_near: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-near-query description: 'Matches spans which are near one another. You can specify `slop`, the maximum number of intervening unmatched positions, as well as whether matches are required to be in-order.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNearQuery' span_not: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-not-query description: Removes matches which overlap with another span query or which are within x tokens before (controlled by the parameter `pre`) or y tokens after (controlled by the parameter `post`) another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNotQuery' span_or: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-query description: Matches the union of its span clauses. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanOrQuery' span_term: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-term-query description: Matches spans containing a term. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.SpanTermQuery' minProperties: 1 maxProperties: 1 span_within: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-within-query description: Returns matches which are enclosed inside another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanWithinQuery' sparse_vector: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-sparse-vector-query description: Using input query vectors or a natural language processing model to convert a query into a list of token-weight pairs, queries against a sparse vector field. x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.SparseVectorQuery' term: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-term-query description: 'Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field''s value, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermQuery' minProperties: 1 maxProperties: 1 terms: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-terms-query description: 'Returns documents that contain one or more exact terms in a provided field. To return a document, one or more terms must exactly match a field value, including whitespace and capitalization.' allOf: - $ref: '#/components/schemas/_types.query_dsl.TermsQuery' terms_set: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-terms-set-query description: 'Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermsSetQuery' minProperties: 1 maxProperties: 1 text_expansion: deprecated: true externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-text-expansion-query description: Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field. x-state: Generally available; Added in 8.8.0 type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TextExpansionQuery' minProperties: 1 maxProperties: 1 weighted_tokens: deprecated: true externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-weighted-tokens-query description: Supports returning text_expansion query results by sending in precomputed tokens with the query. x-state: Generally available; Added in 8.13.0 type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WeightedTokensQuery' minProperties: 1 maxProperties: 1 wildcard: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-wildcard-query description: Returns documents that contain terms matching a wildcard pattern. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WildcardQuery' minProperties: 1 maxProperties: 1 wrapper: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-wrapper-query description: A query that accepts any other query as base64 encoded string. allOf: - $ref: '#/components/schemas/_types.query_dsl.WrapperQuery' type: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.TypeQuery' minProperties: 1 maxProperties: 1 security.query_user.UserQueryContainer: type: object properties: ids: description: 'Returns users based on their IDs. This query uses the user document IDs stored in the `_id` field.' allOf: - $ref: '#/components/schemas/_types.query_dsl.IdsQuery' bool: description: matches users matching boolean combinations of other queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoolQuery' exists: description: Returns users that contain an indexed value for a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.ExistsQuery' match: description: 'Returns users that match a provided text, number, date or boolean value. The provided text is analyzed before matching.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchQuery' minProperties: 1 maxProperties: 1 match_all: description: Matches all users, giving them all a `_score` of 1.0. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchAllQuery' prefix: description: Returns users that contain a specific prefix in a provided field. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.PrefixQuery' minProperties: 1 maxProperties: 1 range: description: Returns users that contain terms within a provided range. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RangeQuery' minProperties: 1 maxProperties: 1 simple_query_string: description: Returns users based on a provided query string, using a parser with a limited but fault-tolerant syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringQuery' term: description: 'Returns users that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field''s value, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermQuery' minProperties: 1 maxProperties: 1 terms: description: 'Returns users that contain one or more exact terms in a provided field. To return a document, one or more terms must exactly match a field value, including whitespace and capitalization.' allOf: - $ref: '#/components/schemas/_types.query_dsl.TermsQuery' wildcard: description: Returns users that contain terms matching a wildcard pattern. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WildcardQuery' minProperties: 1 maxProperties: 1 minProperties: 1 maxProperties: 1 _types.analysis.HindiNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - hindi_normalization required: - type _types.aggregations.MinimumInterval: type: string enum: - second - minute - hour - day - month - year security._types.DataSourcePrivilege: anyOf: - type: string enum: - create - delete - read_metadata - read - manage - type: string _types.ScoreSort: type: object properties: order: allOf: - $ref: '#/components/schemas/_types.SortOrder' indices._types.MappingLimitSettingsDepth: type: object properties: limit: description: 'The maximum depth for a field, which is measured as the number of inner objects. For instance, if all fields are defined at the root object level, then the depth is 1. If there is one object mapping, then the depth is 2, etc.' default: 20.0 type: number _types.aggregations.BucketSortAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: from: description: Buckets in positions prior to `from` will be truncated. type: number gap_policy: description: The policy to apply when gaps are found in the data. default: skip allOf: - $ref: '#/components/schemas/_types.aggregations.GapPolicy' size: description: 'The number of buckets to return. Defaults to all buckets of the parent aggregation.' type: number sort: description: The list of fields to sort on. allOf: - $ref: '#/components/schemas/_types.Sort' _types.query_dsl.CommonTermsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: type: string cutoff_frequency: type: number high_freq_operator: allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' low_freq_operator: allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' minimum_should_match: allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' query: type: string required: - query _spec_utils.PipeSeparatedFlagsSimpleQueryStringFlag: description: 'A set of flags that can be represented as a single enum value or a set of values that are encoded as a pipe-separated string Depending on the target language, code generators can use this hint to generate language specific flags enum constructs and the corresponding (de-)serialization code.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringFlag' - type: string _types.aggregations.BucketsApiKeyQueryContainer: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/security.query_api_keys.ApiKeyQueryContainer' - type: array items: $ref: '#/components/schemas/security.query_api_keys.ApiKeyQueryContainer' _types.KnnQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: The name of the vector field to search against allOf: - $ref: '#/components/schemas/_types.Field' query_vector: description: The query vector allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: The query vector builder. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' num_candidates: description: The number of nearest neighbor candidates to consider per shard type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number k: description: The final number of nearest neighbors to return as top hits type: number filter: description: Filters for the kNN search query oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' similarity: description: The minimum similarity for a vector to be considered a match type: number rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' required: - field _types.Fuzziness: oneOf: - type: string - type: number _types.analysis.JaStopTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - ja_stop stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' required: - type _types.EmptyObject: description: For empty Class assignments type: object _types.SortMode: type: string enum: - min - max - sum - avg - median _types.query_dsl.PinnedDoc: type: object properties: _id: description: The unique document ID. allOf: - $ref: '#/components/schemas/_types.Id' _index: description: The index that contains the document. allOf: - $ref: '#/components/schemas/_types.IndexName' required: - _id indices._types.StorageType: anyOf: - type: string enum: - fs - niofs - mmapfs - hybridfs - type: string security._types.ApplicationGlobalUserPrivileges: type: object properties: manage: allOf: - $ref: '#/components/schemas/security._types.ManageUserPrivileges' required: - manage _types.analysis.ArabicStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - arabic_stem required: - type _global.search._types.Rescore: allOf: - type: object properties: window_size: type: number - type: object properties: query: allOf: - $ref: '#/components/schemas/_global.search._types.RescoreQuery' learning_to_rank: allOf: - $ref: '#/components/schemas/_global.search._types.LearningToRank' script: allOf: - $ref: '#/components/schemas/_global.search._types.ScriptRescore' minProperties: 1 maxProperties: 1 security.authenticate.Token: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' type: x-state: Generally available; Added in 7.14.0 type: string managed_by: x-state: Generally available; Added in 9.4.0 allOf: - $ref: '#/components/schemas/security._types.CredentialManagedBy' _types.QueryVector: type: array items: type: number _types.aggregations.BucketsQueryContainer: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' _types.query_dsl.DistanceFeatureQueryBase: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' type: object pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' type: object field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field _types.Name: type: string _types.aggregations.SumBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.aggregations.Missing: oneOf: - type: string - type: number - type: number - type: boolean _types.aggregations.DateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: calendar_interval: description: 'Calendar-aware interval. Can be specified using the unit name, such as `month`, or as a single unit quantity, such as `1M`.' allOf: - $ref: '#/components/schemas/_types.aggregations.CalendarInterval' extended_bounds: description: Enables extending the bounds of the histogram beyond the data itself. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsFieldDateMath' hard_bounds: description: Limits the histogram to specified bounds. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsFieldDateMath' field: description: The date field whose values are use to build a histogram. allOf: - $ref: '#/components/schemas/_types.Field' fixed_interval: description: 'Fixed intervals: a fixed number of SI units and never deviate, regardless of where they fall on the calendar.' allOf: - $ref: '#/components/schemas/_types.Duration' format: description: 'The date format used to format `key_as_string` in the response. If no `format` is specified, the first date format specified in the field mapping is used.' type: string interval: deprecated: true allOf: - $ref: '#/components/schemas/_types.Duration' min_doc_count: description: 'Only returns buckets that have `min_doc_count` number of documents. By default, all buckets between the first bucket that matches documents and the last one are returned.' type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.DateTime' offset: description: Changes the start value of each bucket by the specified positive (`+`) or negative offset (`-`) duration. allOf: - $ref: '#/components/schemas/_types.Duration' order: description: The sort order of the returned buckets. allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' params: type: object additionalProperties: type: object script: allOf: - $ref: '#/components/schemas/_types.Script' time_zone: description: 'Time zone used for bucketing and rounding. Defaults to Coordinated Universal Time (UTC).' allOf: - $ref: '#/components/schemas/_types.TimeZone' keyed: description: Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array. type: boolean _types.query_dsl.RangeQueryBasedouble: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: Indicates how the range query matches values for `range` fields. default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: number gte: description: Greater than or equal to. type: number lt: description: Less than. type: number lte: description: Less than or equal to. type: number indices._types.MappingLimitSettingsDimensionFields: type: object properties: limit: description: '[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.' type: number _types.aggregations.MultiTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketBase' - type: object properties: key: type: array items: $ref: '#/components/schemas/_types.FieldValue' key_as_string: type: string doc_count_error_upper_bound: type: number required: - key _types.aggregations.TermsBucketBase: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketBase' - type: object properties: doc_count_error_upper_bound: type: number xpack.usage.SecurityRolesDlsBitSetCache: type: object properties: count: description: Number of entries in the cache. type: number memory: description: Human-readable amount of memory taken up by the cache. allOf: - $ref: '#/components/schemas/_types.ByteSize' memory_in_bytes: description: Memory taken up by the cache in bytes. allOf: - $ref: '#/components/schemas/_types.ulong' hits: description: Total number of cache hits. x-state: Generally available; Added in 9.2.0 type: number misses: description: Total number of cache misses. x-state: Generally available; Added in 9.2.0 type: number evictions: description: Total number of cache evictions. x-state: Generally available; Added in 9.2.0 type: number hits_time_in_millis: description: Total combined time spent in cache for hits in milliseconds. x-state: Generally available; Added in 9.2.0 allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' misses_time_in_millis: description: Total combined time spent in cache for misses in milliseconds. x-state: Generally available; Added in 9.2.0 allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' required: - count - memory_in_bytes - hits - misses - evictions - hits_time_in_millis - misses_time_in_millis _types.query_dsl.IdsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: values: description: An array of document IDs. allOf: - $ref: '#/components/schemas/_types.Ids' _types.query_dsl.BoostingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: negative_boost: description: Floating point number between 0 and 1.0 used to decrease the relevance scores of documents matching the `negative` query. type: number negative: description: Query used to decrease the relevance score of matching documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' positive: description: Any returned documents must match this query. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - negative_boost - negative - positive _global.search._types.HighlighterEncoder: type: string enum: - default - html _types.query_dsl.QueryStringQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: allow_leading_wildcard: description: If `true`, the wildcard characters `*` and `?` are allowed as the first character of the query string. default: true type: boolean analyzer: description: Analyzer used to convert text in the query string into tokens. type: string analyze_wildcard: description: If `true`, the query attempts to analyze wildcard terms in the query string. default: false type: boolean auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean default_field: description: 'Default field to search if no field is provided in the query string. Supports wildcards (`*`). Defaults to the `index.query.default_field` index setting, which has a default value of `*`.' allOf: - $ref: '#/components/schemas/_types.Field' default_operator: description: Default boolean logic used to interpret text in the query string if no operators are specified. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' enable_position_increments: description: If `true`, enable position increments in queries constructed from a `query_string` search. default: true type: boolean escape: default: false type: boolean fields: description: Array of fields to search. Supports wildcards (`*`). type: array items: $ref: '#/components/schemas/_types.Field' fuzziness: description: Maximum edit distance allowed for fuzzy matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_max_expansions: description: Maximum number of terms to which the query expands for fuzzy matching. default: 50.0 type: number fuzzy_prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text value for a numeric field, are ignored. default: false type: boolean max_determinized_states: description: Maximum number of automaton states required for the query. default: 10000.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' phrase_slop: description: Maximum number of positions allowed between matching tokens for phrases. default: 0.0 type: number query: description: Query string you wish to parse and use for search. type: string quote_analyzer: description: 'Analyzer used to convert quoted text in the query string into tokens. For quoted text, this parameter overrides the analyzer specified in the `analyzer` parameter.' type: string quote_field_suffix: description: 'Suffix appended to quoted text in the query string. You can use this suffix to use a different analysis method for exact matches.' type: string rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' tie_breaker: description: How to combine the queries generated from the individual search terms in the resulting `dis_max` query. type: number time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert date values in the query string to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' type: description: Determines how the query matches and scores documents. default: '''best_fields''' allOf: - $ref: '#/components/schemas/_types.query_dsl.TextQueryType' required: - query security.query_api_keys.ApiKeyAggregationContainer: allOf: - type: object properties: aggregations: description: 'Sub-aggregations for this aggregation. Only applies to bucket aggregations.' type: object additionalProperties: $ref: '#/components/schemas/security.query_api_keys.ApiKeyAggregationContainer' meta: allOf: - $ref: '#/components/schemas/_types.Metadata' - type: object properties: cardinality: description: A single-value metrics aggregation that calculates an approximate count of distinct values. allOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityAggregation' composite: description: 'A multi-bucket aggregation that creates composite buckets from different sources. Unlike the other multi-bucket aggregations, you can use the `composite` aggregation to paginate *all* buckets from a multi-level aggregation efficiently.' allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregation' date_range: description: A multi-bucket value source based aggregation that enables the user to define a set of date ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.DateRangeAggregation' filter: description: A single bucket aggregation that narrows the set of documents to those that match a query. allOf: - $ref: '#/components/schemas/security.query_api_keys.ApiKeyQueryContainer' filters: description: A multi-bucket aggregation where each bucket contains the documents that match a query. allOf: - $ref: '#/components/schemas/security.query_api_keys.ApiKeyFiltersAggregation' missing: allOf: - $ref: '#/components/schemas/_types.aggregations.MissingAggregation' range: description: A multi-bucket value source based aggregation that enables the user to define a set of ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.RangeAggregation' terms: description: A multi-bucket value source based aggregation where buckets are dynamically built - one per unique value. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregation' value_count: description: A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.ValueCountAggregation' minProperties: 1 maxProperties: 1 security.has_privileges.IndexPrivilegesCheck: type: object properties: names: description: A list of indices. allOf: - $ref: '#/components/schemas/_types.Indices' privileges: description: A list of the privileges that you want to check for the specified indices. type: array items: $ref: '#/components/schemas/security._types.IndexPrivilege' allow_restricted_indices: description: 'This needs to be set to `true` (default is `false`) if using wildcards or regexps for patterns that cover restricted indices. Implicitly, restricted indices do not match index patterns because restricted indices usually have limited privileges and including them in pattern tests would render most such tests false. If restricted indices are explicitly included in the names list, privileges will be checked against them regardless of the value of `allow_restricted_indices`.' type: boolean required: - names - privileges _types.query_dsl.SpanWithinQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: big: description: 'Can be any span query. Matching spans from `little` that are enclosed within `big` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' little: description: 'Can be any span query. Matching spans from `little` that are enclosed within `big` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - big - little indices._types.CacheQueries: type: object properties: enabled: type: boolean required: - enabled _types.MultiTermQueryRewrite: type: string _types.analysis.RussianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - russian_stem required: - type _types.aggregations.WeightedAverageValue: type: object properties: field: description: The field from which to extract the values or weights. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: A value or weight to use if the field is missing. type: number script: allOf: - $ref: '#/components/schemas/_types.Script' indices._types.MergeScheduler: type: object properties: max_thread_count: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' max_merge_count: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' _types.query_dsl.IntervalsRegexp: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string pattern: description: Regex pattern. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - pattern _types.analysis.KeywordAnalyzer: type: object properties: type: type: string enum: - keyword version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' required: - type indices._types.IndexingPressure: type: object properties: memory: allOf: - $ref: '#/components/schemas/indices._types.IndexingPressureMemory' required: - memory _types.query_dsl.DecayFunctionBaseDateMathDuration: type: object properties: multi_value_mode: description: Determines how the distance is calculated when a field used for computing the decay contains multiple values. default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.analysis.KeywordRepeatTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keyword_repeat required: - type _types.analysis.BrazilianAnalyzer: type: object properties: type: type: string enum: - brazilian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type security._types.Access: type: object properties: replication: description: A list of indices permission entries for cross-cluster replication. type: array items: $ref: '#/components/schemas/security._types.ReplicationAccess' search: description: A list of indices permission entries for cross-cluster search. type: array items: $ref: '#/components/schemas/security._types.SearchAccess' _types.aggregations.DoubleTermsAggregate: description: Result of a `terms` aggregation when the field is some kind of decimal number like a float, double, or distance. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregateBaseDoubleTermsBucket' - type: object _types.analysis.LowercaseNormalizer: type: object properties: type: type: string enum: - lowercase required: - type _types.analysis.WhitespaceTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - whitespace max_token_length: type: number required: - type _global.search._types.InnerHits: type: object properties: name: description: 'The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits.' allOf: - $ref: '#/components/schemas/_types.Name' size: description: The maximum number of hits to return per `inner_hits`. default: 3.0 type: number from: description: Inner hit starting document offset. default: 0.0 type: number collapse: allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' docvalue_fields: type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' explain: type: boolean highlight: allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' ignore_unmapped: type: boolean script_fields: type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' seq_no_primary_term: type: boolean field: type: array items: $ref: '#/components/schemas/_types.Field' fields: type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' sort: description: 'How the inner hits should be sorted per `inner_hits`. By default, inner hits are sorted by score.' allOf: - $ref: '#/components/schemas/_types.Sort' _source: allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' stored_fields: allOf: - $ref: '#/components/schemas/_types.Fields' track_scores: default: false type: boolean version: type: boolean _types.query_dsl.SpanQuery: type: object properties: span_containing: description: Accepts a list of span queries, but only returns those spans which also match a second span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanContainingQuery' span_field_masking: description: Allows queries like `span_near` or `span_or` across different fields. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFieldMaskingQuery' span_first: description: Accepts another span query whose matches must appear within the first N positions of the field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFirstQuery' span_gap: allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanGapQuery' span_multi: description: Wraps a `term`, `range`, `prefix`, `wildcard`, `regexp`, or `fuzzy` query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanMultiTermQuery' span_near: description: Accepts multiple span queries whose matches must be within the specified distance of each other, and possibly in the same order. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNearQuery' span_not: description: Wraps another span query, and excludes any documents which match that query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNotQuery' span_or: description: Combines multiple span queries and returns documents which match any of the specified queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanOrQuery' span_term: description: The equivalent of the `term` query but for use with other span queries. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.SpanTermQuery' minProperties: 1 maxProperties: 1 span_within: description: The result from a single span query is returned as long is its span falls within the spans returned by a list of other span queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanWithinQuery' minProperties: 1 maxProperties: 1 indices._types.IndexRoutingAllocationDisk: type: object properties: threshold_enabled: oneOf: - type: boolean - type: string _types.aggregations.TDigestExecutionHint: type: string enum: - default - high_accuracy security._types.ApplicationPrivileges: type: object properties: application: description: The name of the application to which this entry applies. type: string privileges: description: A list of strings, where each element is the name of an application privilege or action. type: array items: type: string resources: description: A list resources to which the privileges are applied. type: array items: type: string required: - application - privileges - resources _global.search._types.RescoreQuery: type: object properties: rescore_query: description: 'The query to use for rescoring. This query is only run on the Top-K results returned by the `query` and `post_filter` phases.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_weight: description: Relative importance of the original query versus the rescore query. default: 1.0 type: number rescore_query_weight: description: Relative importance of the rescore query versus the original query. default: 1.0 type: number score_mode: description: Determines how scores are combined. default: total allOf: - $ref: '#/components/schemas/_global.search._types.ScoreMode' required: - rescore_query _types.aggregations.MissingOrder: type: string enum: - first - last - default _types.ScriptLanguage: anyOf: - type: string enum: - painless - expression - mustache - java - type: string ssl.certificates.CertificateInformation: type: object properties: alias: description: 'If the path refers to a container file (a jks keystore, or a PKCS#12 file), it is the alias of the certificate. Otherwise, it is null.' oneOf: - type: string - type: - string - 'null' expiry: description: The ISO formatted date of the certificate's expiry (not-after) date. allOf: - $ref: '#/components/schemas/_types.DateTime' format: description: 'The format of the file. Valid values include `jks`, `PKCS12`, and `PEM`.' type: string has_private_key: description: Indicates whether Elasticsearch has access to the private key for this certificate. type: boolean issuer: description: The Distinguished Name of the certificate's issuer. type: string path: description: The path to the certificate, as configured in the `elasticsearch.yml` file. type: string serial_number: description: The hexadecimal representation of the certificate's serial number. type: string subject_dn: description: The Distinguished Name of the certificate's subject. type: string required: - alias - expiry - format - has_private_key - path - serial_number - subject_dn _types.query_dsl.SpanGapQuery: description: Can only be used as a clause in a span_near query. type: object additionalProperties: type: number minProperties: 1 maxProperties: 1 _types.analysis.WordDelimiterTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: catenate_all: description: If `true`, the filter produces catenated tokens for chains of alphanumeric characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean catenate_numbers: description: If `true`, the filter produces catenated tokens for chains of numeric characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean catenate_words: description: If `true`, the filter produces catenated tokens for chains of alphabetical characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean generate_number_parts: description: If `true`, the filter includes tokens consisting of only numeric characters in the output. If `false`, the filter excludes these tokens from the output. Defaults to `true`. type: boolean generate_word_parts: description: If `true`, the filter includes tokens consisting of only alphabetical characters in the output. If `false`, the filter excludes these tokens from the output. Defaults to `true`. type: boolean preserve_original: description: If `true`, the filter includes the original version of any split tokens in the output. This original version includes non-alphanumeric delimiters. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' protected_words: description: Array of tokens the filter won’t split. type: array items: type: string protected_words_path: description: 'Path to a file that contains a list of tokens the filter won’t split. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each token in the file must be separated by a line break.' type: string split_on_case_change: description: 'If `true`, the filter splits tokens at letter case transitions. For example: camelCase -> [ camel, Case ]. Defaults to `true`.' type: boolean split_on_numerics: description: 'If `true`, the filter splits tokens at letter-number transitions. For example: j2se -> [ j, 2, se ]. Defaults to `true`.' type: boolean stem_english_possessive: description: 'If `true`, the filter removes the English possessive (`''s`) from the end of each token. For example: O''Neil''s -> [ O, Neil ]. Defaults to `true`.' type: boolean type_table: description: Array of custom type mappings for characters. This allows you to map non-alphanumeric characters as numeric or alphanumeric to avoid splitting on those characters. type: array items: type: string type_table_path: description: Path to a file that contains custom type mappings for characters. This allows you to map non-alphanumeric characters as numeric or alphanumeric to avoid splitting on those characters. type: string _types.query_dsl.ExistsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: Name of the field you wish to search. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.analysis.EnglishAnalyzer: type: object properties: type: type: string enum: - english stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.RankBase: type: object _types.analysis.SynonymFormat: type: string enum: - solr - wordnet _types.RetrieverContainer: type: object properties: standard: description: A retriever that replaces the functionality of a traditional query. allOf: - $ref: '#/components/schemas/_types.StandardRetriever' knn: description: A retriever that replaces the functionality of a knn search. allOf: - $ref: '#/components/schemas/_types.KnnRetriever' rrf: description: A retriever that produces top documents from reciprocal rank fusion (RRF). allOf: - $ref: '#/components/schemas/_types.RRFRetriever' text_similarity_reranker: description: A retriever that reranks the top documents based on a reranking model using the InferenceAPI allOf: - $ref: '#/components/schemas/_types.TextSimilarityReranker' rule: description: A retriever that replaces the functionality of a rule query. allOf: - $ref: '#/components/schemas/_types.RuleRetriever' rescorer: description: A retriever that re-scores only the results produced by its child retriever. allOf: - $ref: '#/components/schemas/_types.RescorerRetriever' linear: description: A retriever that supports the combination of different retrievers through a weighted linear combination. allOf: - $ref: '#/components/schemas/_types.LinearRetriever' pinned: description: 'A pinned retriever applies pinned documents to the underlying retriever. This retriever will rewrite to a PinnedQueryBuilder.' allOf: - $ref: '#/components/schemas/_types.PinnedRetriever' diversify: description: A retriever that diversifies the results from its child retriever. allOf: - $ref: '#/components/schemas/_types.DiversifyRetriever' minProperties: 1 maxProperties: 1 _types.analysis.SpanishAnalyzer: type: object properties: type: type: string enum: - spanish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.VersionString: type: string _types.query_dsl.ParentIdQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: id: description: ID of the parent document. allOf: - $ref: '#/components/schemas/_types.Id' ignore_unmapped: description: Indicates whether to ignore an unmapped `type` and not return any documents instead of an error. default: false type: boolean type: description: Name of the child relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' indices._types.IndexSettingsTimeSeries: type: object properties: end_time: allOf: - $ref: '#/components/schemas/_types.DateTime' start_time: allOf: - $ref: '#/components/schemas/_types.DateTime' temporality_field: description: 'The name of the field that stores the temporality of a metric. The referenced field must be a `keyword` dimension field; if the setting is unset or the field is missing or invalid, the metric temporality resolves to null.' x-state: Generally available; Added in 9.4.0 allOf: - $ref: '#/components/schemas/_types.Field' _types.analysis.FrenchStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - french_stem required: - type _types.analysis.KeepTypesTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keep_types mode: description: Indicates whether to keep or remove the specified token types. allOf: - $ref: '#/components/schemas/_types.analysis.KeepTypesMode' types: description: List of token types to keep or remove. type: array items: type: string required: - type - types _types.RelationName: type: string _types.query_dsl.GeoPolygonQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: validation_method: default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: type: boolean _spec_utils.Void: description: 'The absence of any type. This is commonly used in APIs that don''t return a body. Although "void" is generally used for the unit type that has only one value, this is to be interpreted as the bottom type that has no value at all. Most languages have a unit type, but few have a bottom type. See https://en.m.wikipedia.org/wiki/Unit_type and https://en.m.wikipedia.org/wiki/Bottom_type' type: object _types.query_dsl.MatchAllQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object _types.analysis.NoriAnalyzer: type: object properties: type: type: string enum: - nori version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' decompound_mode: allOf: - $ref: '#/components/schemas/_types.analysis.NoriDecompoundMode' stoptags: type: array items: type: string user_dictionary: type: string required: - type _types.KnnRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: field: description: The name of the vector field to search against. type: string query_vector: description: Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: Defines a model to build a query vector. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' k: description: Number of nearest neighbors to return as top hits. type: number num_candidates: description: Number of nearest neighbor candidates to consider per shard. type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number similarity: description: The minimum similarity required for a document to be considered a match. type: number rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' required: - field - k _types.analysis.TurkishAnalyzer: type: object properties: type: type: string enum: - turkish stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.TermsAggregateBaseLongTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseLongTermsBucket' - type: object properties: doc_count_error_upper_bound: type: number sum_other_doc_count: type: number _types.mapping.ChunkRescorerChunkingSettings: type: object properties: max_chunk_size: description: 'The maximum size of a chunk in words. This value cannot be lower than `20` (for `sentence` strategy) or `10` (for `word` strategy). This value should not exceed the window size for the associated model.' default: 250.0 type: number overlap: description: 'The number of overlapping words for chunks. It is applicable only to a `word` chunking strategy. This value cannot be higher than half the `max_chunk_size` value.' default: 100.0 type: number sentence_overlap: description: 'The number of overlapping sentences for chunks. It is applicable only for a `sentence` chunking strategy. It can be either `1` or `0`.' default: 1.0 type: number separator_group: description: 'Only applicable to the `recursive` strategy and required when using it. Sets a predefined list of separators in the saved chunking settings based on the selected text type. Values can be `markdown` or `plaintext`. Using this parameter is an alternative to manually specifying a custom `separators` list.' type: string separators: description: 'Only applicable to the `recursive` strategy and required when using it. A list of strings used as possible split points when chunking text. Each string can be a plain string or a regular expression (regex) pattern. The system tries each separator in order to split the text, starting from the first item in the list. After splitting, it attempts to recombine smaller pieces into larger chunks that stay within the `max_chunk_size` limit, to reduce the total number of chunks generated.' type: array items: type: string strategy: externalDocs: url: https://www.elastic.co/docs/explore-analyze/elastic-inference/inference-api#chunking-strategies description: "The chunking strategy: `sentence`, `word`, `none` or `recursive`.\n\n * If `strategy` is set to `recursive`, you must also specify:\n\n- `max_chunk_size`\n- either `separators` or`separator_group`\n\nLearn more about different chunking strategies in the linked documentation." default: sentence type: string required: - max_chunk_size _types.aggregations.IpPrefixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The IP address field to aggregation on. The field mapping type must be `ip`. allOf: - $ref: '#/components/schemas/_types.Field' prefix_length: description: 'Length of the network prefix. For IPv4 addresses the accepted range is [0, 32]. For IPv6 addresses the accepted range is [0, 128].' type: number is_ipv6: description: Defines whether the prefix applies to IPv6 addresses. default: false type: boolean append_prefix_length: description: Defines whether the prefix length is appended to IP address keys in the response. default: false type: boolean keyed: description: Defines whether buckets are returned as a hash rather than an array in the response. type: boolean min_doc_count: description: Minimum number of documents in a bucket for it to be included in the response. default: 1.0 type: number required: - field - prefix_length _types.analysis.IcuCollationCaseFirst: type: string enum: - lower - upper security._types.ReplicationAccess: type: object properties: names: description: A list of indices (or index name patterns) to which the permissions in this entry apply. oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' allow_restricted_indices: description: This needs to be set to true if the patterns in the names field should cover system indices. default: false type: boolean required: - names _types.analysis.SnowballTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - snowball language: description: Controls the language used by the stemmer. allOf: - $ref: '#/components/schemas/_types.analysis.SnowballLanguage' required: - type _types.aggregations.MissingAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The name of the field. allOf: - $ref: '#/components/schemas/_types.Field' missing: allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' _types.aggregations.MaxAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.analysis.PhoneticRuleType: type: string enum: - approx - exact indices._types.SettingsHighlight: type: object properties: max_analyzed_offset: default: 1000000.0 type: number _types.analysis.UniqueTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - unique only_on_same_position: description: If `true`, only remove duplicate tokens in the same position. Defaults to `false`. type: boolean required: - type _types.aggregations.BucketKsAggregation: description: 'A sibling pipeline aggregation which executes a two sample Kolmogorov–Smirnov test (referred to as a "K-S test" from now on) against a provided distribution, and the distribution implied by the documents counts in the configured sibling aggregation. Specifically, for some metric, assuming that the percentile intervals of the metric are known beforehand or have been computed by an aggregation, then one would use range aggregation for the sibling to compute the p-value of the distribution difference between the metric and the restriction of that metric to a subset of the documents. A natural use case is if the sibling aggregation range aggregation nested in a terms aggregation, in which case one compares the overall distribution of metric to its restriction to each term.' allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: alternative: description: 'A list of string values indicating which K-S test alternative to calculate. The valid values are: "greater", "less", "two_sided". This parameter is key for determining the K-S statistic used when calculating the K-S test. Default value is all possible alternative hypotheses.' type: array items: type: string fractions: description: 'A list of doubles indicating the distribution of the samples with which to compare to the `buckets_path` results. In typical usage this is the overall proportion of documents in each bucket, which is compared with the actual document proportions in each bucket from the sibling aggregation counts. The default is to assume that overall documents are uniformly distributed on these buckets, which they would be if one used equal percentiles of a metric to define the bucket end points.' type: array items: type: number sampling_method: description: 'Indicates the sampling methodology when calculating the K-S test. Note, this is sampling of the returned values. This determines the cumulative distribution function (CDF) points used comparing the two samples. Default is `upper_tail`, which emphasizes the upper end of the CDF points. Valid options are: `upper_tail`, `uniform`, and `lower_tail`.' type: string _types.KnnEmbeddingInput: description: 'Knn embedding input. Either a string, an object or array of objects' oneOf: - type: string - $ref: '#/components/schemas/_types.InferenceStringGroup' _types.RRFRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retrievers: description: A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter. type: array items: $ref: '#/components/schemas/_types.RRFRetrieverEntry' rank_constant: description: This value determines how much influence documents in individual result sets per query have over the final ranked result set. type: number rank_window_size: description: This value determines the size of the individual result sets per query. type: number query: type: string fields: type: array items: type: string required: - retrievers _types.InferenceString: type: object properties: type: description: The type of data that the value represents. allOf: - $ref: '#/components/schemas/inference._types.EmbeddingContentType' format: description: The format of the data. If null, the default data format for the given type is used. oneOf: - $ref: '#/components/schemas/inference._types.EmbeddingContentFormat' - type: - string - 'null' value: description: String which may be raw text, or the string representation of some other data such as an image in base64. type: string required: - type - value _global.search._types.HighlightField: allOf: - $ref: '#/components/schemas/_global.search._types.HighlightBase' - type: object properties: fragment_offset: type: number matched_fields: allOf: - $ref: '#/components/schemas/_types.Fields' _types.aggregations.SumAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.aggregations.ExtendedStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: sigma: description: The number of standard deviations above/below the mean to display. type: number _types.analysis.SynonymTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: expand: description: Expands definitions for equivalent synonym rules. Defaults to `true`. type: boolean format: description: Sets the synonym rules format. allOf: - $ref: '#/components/schemas/_types.analysis.SynonymFormat' lenient: description: If `true` ignores errors while parsing the synonym rules. It is important to note that only those synonym rules which cannot get parsed are ignored. Defaults to the value of the `updateable` setting. type: boolean synonyms: description: Used to define inline synonyms. type: array items: type: string synonyms_path: description: Used to provide a synonym file. This path must be absolute or relative to the `config` location. type: string synonyms_set: description: Provide one or more synonym sets created through the Synonyms Management APIs. Maximum 100 sets per filter. oneOf: - type: string - type: array items: type: string tokenizer: deprecated: true description: Controls the tokenizers that will be used to tokenize the synonym, this parameter is for backwards compatibility for indices that created before 6.0. type: string updateable: description: If `true` allows reloading search analyzers to pick up changes to synonym files. Only to be used for search analyzers. Defaults to `false`. type: boolean _types.analysis.KuromojiStemmerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_stemmer minimum_length: type: number required: - type - minimum_length security.grant_api_key.GrantApiKey: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' expiration: description: Expiration time for the API key. By default, API keys never expire. allOf: - $ref: '#/components/schemas/_types.DurationLarge' role_descriptors: description: 'The role descriptors for this API key. When it is not specified or is an empty array, the API key has a point in time snapshot of permissions of the specified user or access token. If you supply role descriptors, the resultant permissions are an intersection of API keys permissions and the permissions of the user or access token.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' - type: array items: type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' metadata: description: 'Arbitrary metadata that you want to associate with the API key. It supports nested data structure. Within the `metadata` object, keys beginning with `_` are reserved for system usage.' allOf: - $ref: '#/components/schemas/_types.Metadata' required: - name _global.search._types.LearningToRank: type: object properties: model_id: description: The unique identifier of the trained model uploaded to Elasticsearch type: string params: description: Named parameters to be passed to the query templates used for feature type: object additionalProperties: type: object required: - model_id indices._types.SourceMode: type: string enum: - disabled - stored - synthetic _types.ScriptSortType: type: string enum: - string - number - version indices._types.IndexSettingsLifecycle: type: object properties: name: description: The name of the policy to use to manage the index. For information about how Elasticsearch applies policy changes, see Policy updates. allOf: - $ref: '#/components/schemas/_types.Name' indexing_complete: description: 'Indicates whether or not the index has been rolled over. Automatically set to true when ILM completes the rollover action. You can explicitly set it to skip rollover.' default: 'false' allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' origination_date: description: 'If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.' default: 0.0 type: number parse_origination_date: description: 'Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern ^.*-{date_format}-\\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.' type: boolean step: allOf: - $ref: '#/components/schemas/indices._types.IndexSettingsLifecycleStep' rollover_alias: description: 'The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.' default: '' type: string prefer_ilm: description: 'Preference for the system that manages a data stream backing index (preferring ILM when both ILM and DLM are applicable for an index).' default: 'true' oneOf: - type: boolean - type: string _types.query_dsl.IntervalsContainer: type: object properties: all_of: description: Returns matches that span a combination of other rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAllOf' any_of: description: Returns intervals produced by any of its sub-rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAnyOf' fuzzy: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFuzzy' match: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsMatch' prefix: description: Matches terms that start with a specified set of characters. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsPrefix' range: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRange' regexp: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRegexp' wildcard: description: Matches terms using a wildcard pattern. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsWildcard' minProperties: 1 maxProperties: 1 indices._types.SegmentSortMissing: type: string enum: - _last - _first ml._types.RegressionInferenceOptions: type: object properties: results_field: description: The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value. allOf: - $ref: '#/components/schemas/_types.Field' num_top_feature_importance_values: description: Specifies the maximum number of feature importance values per document. default: 0.0 type: number _types.mapping.RuntimeField: type: object properties: fields: description: For type `composite` type: object additionalProperties: $ref: '#/components/schemas/_types.mapping.CompositeSubField' fetch_fields: description: For type `lookup` type: array items: $ref: '#/components/schemas/_types.mapping.RuntimeFieldFetchFields' format: description: A custom format for `date` type runtime fields. type: string input_field: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.Field' target_field: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.Field' target_index: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.IndexName' script: description: Painless script executed at query time. allOf: - $ref: '#/components/schemas/_types.Script' on_script_error: allOf: - $ref: '#/components/schemas/_types.mapping.OnScriptError' type: description: 'Field type, which can be: `boolean`, `composite`, `date`, `double`, `geo_point`, `ip`,`keyword`, `long`, or `lookup`.' allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFieldType' required: - type indices._types.SettingsSimilarityIb: type: object properties: type: type: string enum: - IB distribution: allOf: - $ref: '#/components/schemas/_types.IBDistribution' lambda: allOf: - $ref: '#/components/schemas/_types.IBLambda' normalization: allOf: - $ref: '#/components/schemas/_types.Normalization' required: - type - distribution - lambda - normalization _types.DFIIndependenceMeasure: type: string enum: - standardized - saturated - chisquared _types.query_dsl.RandomScoreFunction: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' seed: oneOf: - type: number - type: string _types.aggregations.MedianAbsoluteDeviationAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. default: 1000.0 type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' _types.query_dsl.LikeDocument: type: object properties: doc: description: A document not present in the index. type: object fields: type: array items: $ref: '#/components/schemas/_types.Field' _id: description: ID of a document. allOf: - $ref: '#/components/schemas/_types.Id' _index: description: Index of a document. allOf: - $ref: '#/components/schemas/_types.IndexName' per_field_analyzer: description: Overrides the default analyzer. type: object additionalProperties: type: string routing: allOf: - $ref: '#/components/schemas/_types.Routing' version: allOf: - $ref: '#/components/schemas/_types.VersionNumber' version_type: default: '''internal''' allOf: - $ref: '#/components/schemas/_types.VersionType' _types.aggregations.RangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are use to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: number ranges: description: An array of ranges used to bucket documents. type: array items: $ref: '#/components/schemas/_types.aggregations.AggregationRange' script: allOf: - $ref: '#/components/schemas/_types.Script' keyed: description: Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array. type: boolean format: type: string _types.analysis.IcuCollationStrength: type: string enum: - primary - secondary - tertiary - quaternary - identical _types.analysis.GermanStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - german_stem required: - type _types.analysis.CharFilter: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/character-filter-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.CharFilterDefinition' _types.analysis.TruncateTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - truncate length: description: Character limit for each token. Tokens exceeding this limit are truncated. Defaults to `10`. type: number required: - type _types.analysis.LimitTokenCountTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - limit consume_all_tokens: description: If `true`, the limit filter exhausts the token stream, even if the `max_token_count` has already been reached. Defaults to `false`. type: boolean max_token_count: description: Maximum number of tokens to keep. Once this limit is reached, any remaining tokens are excluded from the output. Defaults to `1`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' required: - type _types.aggregations.TermsAggregateBaseMultiTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseMultiTermsBucket' - type: object properties: doc_count_error_upper_bound: type: number sum_other_doc_count: type: number _types.analysis.GermanAnalyzer: type: object properties: type: type: string enum: - german stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.aggregations.SamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: shard_size: description: Limits how many top-scoring documents are collected in the sample processed on each shard. default: 100.0 type: number _types.query_dsl.PinnedQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-pinned-query allOf: - type: object properties: organic: description: Any choice of query used to rank documents which will be ranked below the "pinned" documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - organic - type: object properties: ids: description: 'Document IDs listed in the order they are to appear in results. Required if `docs` is not specified.' type: array items: $ref: '#/components/schemas/_types.Id' docs: description: 'Documents listed in the order they are to appear in results. Required if `ids` is not specified.' type: array items: $ref: '#/components/schemas/_types.query_dsl.PinnedDoc' minProperties: 1 maxProperties: 1 _global.search._types.HighlighterTagsSchema: type: string enum: - styled _types.aggregations.FiltersBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketBase' - type: object properties: key: type: string _types.aggregations.IpRangeAggregationRange: type: object properties: from: description: Start of the range. oneOf: - type: string - type: - string - 'null' mask: description: IP range defined as a CIDR mask. type: string to: description: End of the range. oneOf: - type: string - type: - string - 'null' _types.ScriptSort: type: object properties: order: allOf: - $ref: '#/components/schemas/_types.SortOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' type: allOf: - $ref: '#/components/schemas/_types.ScriptSortType' mode: allOf: - $ref: '#/components/schemas/_types.SortMode' nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' required: - script _types.query_dsl.FunctionScoreContainer: allOf: - type: object properties: filter: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' weight: type: number _name: description: A name to identify which function matched and influenced the score. x-state: Generally available; Added in 9.4.0 type: string - type: object properties: exp: description: Function that scores a document with a exponential decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' gauss: description: Function that scores a document with a normal decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' linear: description: Function that scores a document with a linear decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' field_value_factor: description: 'Function allows you to use a field from a document to influence the score. It’s similar to using the script_score function, however, it avoids the overhead of scripting.' allOf: - $ref: '#/components/schemas/_types.query_dsl.FieldValueFactorScoreFunction' random_score: description: 'Generates scores that are uniformly distributed from 0 up to but not including 1. In case you want scores to be reproducible, it is possible to provide a `seed` and `field`.' allOf: - $ref: '#/components/schemas/_types.query_dsl.RandomScoreFunction' script_score: description: Enables you to wrap another query and customize the scoring of it optionally with a computation derived from other numeric field values in the doc using a script expression. allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptScoreFunction' minProperties: 1 maxProperties: 1 _types.analysis.StopAnalyzer: type: object properties: type: type: string enum: - stop version: deprecated: true allOf: - $ref: '#/components/schemas/_types.VersionString' stopwords: description: 'A pre-defined stop words list like `_english_` or an array containing a list of stop words. Defaults to `_none_`.' default: _none_ allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: The path to a file containing stop words. type: string required: - type _types.aggregations.HoltWintersType: type: string enum: - add - mult _types.aggregations.MultiTermsAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregateBaseMultiTermsBucket' - type: object _types.aggregations.RangeBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketBase' - type: object properties: from: type: number to: type: number from_as_string: type: string to_as_string: type: string key: description: The bucket key. Present if the aggregation is _not_ keyed type: string _types.aggregations.TermsAggregateBaseVoid: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseVoid' - type: object properties: doc_count_error_upper_bound: type: number sum_other_doc_count: type: number _types.analysis.GalicianAnalyzer: type: object properties: type: type: string enum: - galician stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.analysis.IcuTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - icu_tokenizer rule_files: type: string required: - type - rule_files inference._types.EmbeddingContentFormat: type: string enum: - text - base64 _types.aggregations.RangeAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseRangeBucket' - type: object _types.analysis.WordDelimiterGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilterBase' - type: object properties: type: type: string enum: - word_delimiter_graph adjust_offsets: description: If `true`, the filter adjusts the offsets of split or catenated tokens to better reflect their actual position in the token stream. Defaults to `true`. type: boolean ignore_keywords: description: If `true`, the filter skips tokens with a keyword attribute of true. Defaults to `false`. type: boolean required: - type _types.query_dsl.IntervalsAllOf: type: object properties: intervals: description: An array of rules to combine. All rules must produce a match in a document for the overall source to match. type: array items: $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' max_gaps: description: 'Maximum number of positions between the matching terms. Intervals produced by the rules further apart than this are not considered matches.' default: -1.0 type: number ordered: description: If `true`, intervals produced by the rules should appear in the order in which they are specified. default: false type: boolean filter: description: Rule used to filter returned intervals. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - intervals _types.aggregations.RandomSamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: probability: description: 'The probability that a document will be included in the aggregated data. Must be greater than 0, less than 0.5, or exactly 1. The lower the probability, the fewer documents are matched.' type: number seed: description: 'The seed to generate the random sampling of documents. When a seed is provided, the random subset of documents is the same between calls.' type: number shard_seed: description: When combined with seed, setting shard_seed ensures 100% consistent sampling over shards where data is exactly the same. x-state: Generally available; Added in 8.14.0 type: number required: - probability _types.query_dsl.ShapeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: When set to `true` the query ignores an unmapped field and will not match any documents. type: boolean _types.analysis.CatalanAnalyzer: type: object properties: type: type: string enum: - catalan stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.Translog: type: object properties: sync_interval: description: 'How often the translog is fsynced to disk and committed, regardless of write operations. Values less than 100ms are not allowed.' default: 5s allOf: - $ref: '#/components/schemas/_types.Duration' durability: description: Whether or not to `fsync` and commit the translog after every index, delete, update, or bulk request. default: string allOf: - $ref: '#/components/schemas/indices._types.TranslogDurability' flush_threshold_size: description: 'The translog stores all operations that are not yet safely persisted in Lucene (i.e., are not part of a Lucene commit point). Although these operations are available for reads, they will need to be replayed if the shard was stopped and had to be recovered. This setting controls the maximum total size of these operations, to prevent recoveries from taking too long. Once the maximum size has been reached a flush will happen, generating a new Lucene commit point.' default: 512mb allOf: - $ref: '#/components/schemas/_types.ByteSize' retention: allOf: - $ref: '#/components/schemas/indices._types.TranslogRetention' _types.analysis.PersianAnalyzer: type: object properties: type: type: string enum: - persian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.aggregations.NormalizeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: method: description: The specific method to apply. allOf: - $ref: '#/components/schemas/_types.aggregations.NormalizeMethod' _types.analysis.CjkBigramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - cjk_bigram ignored_scripts: description: Array of character scripts for which to disable bigrams. type: array items: $ref: '#/components/schemas/_types.analysis.CjkBigramIgnoredScript' output_unigrams: description: If `true`, emit tokens in both bigram and unigram form. If `false`, a CJK character is output in unigram form when it has no adjacent characters. Defaults to `false`. type: boolean required: - type _types.analysis.CharFilterDefinition: discriminator: propertyName: type mapping: html_strip: '#/components/schemas/_types.analysis.HtmlStripCharFilter' icu_normalizer: '#/components/schemas/_types.analysis.IcuNormalizationCharFilter' kuromoji_iteration_mark: '#/components/schemas/_types.analysis.KuromojiIterationMarkCharFilter' mapping: '#/components/schemas/_types.analysis.MappingCharFilter' pattern_replace: '#/components/schemas/_types.analysis.PatternReplaceCharFilter' oneOf: - $ref: '#/components/schemas/_types.analysis.HtmlStripCharFilter' - $ref: '#/components/schemas/_types.analysis.MappingCharFilter' - $ref: '#/components/schemas/_types.analysis.PatternReplaceCharFilter' - $ref: '#/components/schemas/_types.analysis.IcuNormalizationCharFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiIterationMarkCharFilter' _types.aggregations.MovingAverageAggregation: discriminator: propertyName: model mapping: ewma: '#/components/schemas/_types.aggregations.EwmaMovingAverageAggregation' holt: '#/components/schemas/_types.aggregations.HoltMovingAverageAggregation' holt_winters: '#/components/schemas/_types.aggregations.HoltWintersMovingAverageAggregation' linear: '#/components/schemas/_types.aggregations.LinearMovingAverageAggregation' simple: '#/components/schemas/_types.aggregations.SimpleMovingAverageAggregation' oneOf: - $ref: '#/components/schemas/_types.aggregations.LinearMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.SimpleMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.EwmaMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.HoltMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.HoltWintersMovingAverageAggregation' _types.query_dsl.SimpleQueryStringFlags: description: Query flags can be either a single flag or a combination of flags, e.g. `OR|AND|PREFIX` allOf: - $ref: '#/components/schemas/_spec_utils.PipeSeparatedFlagsSimpleQueryStringFlag' security._types.UserProfileUser: type: object properties: email: oneOf: - type: string - type: - string - 'null' full_name: oneOf: - $ref: '#/components/schemas/_types.Name' - type: - string - 'null' realm_name: allOf: - $ref: '#/components/schemas/_types.Name' realm_domain: allOf: - $ref: '#/components/schemas/_types.Name' roles: type: array items: type: string username: allOf: - $ref: '#/components/schemas/_types.Username' required: - realm_name - roles - username _types.Names: oneOf: - $ref: '#/components/schemas/_types.Name' - type: array items: $ref: '#/components/schemas/_types.Name' _types.aggregations.CompositeDateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: format: type: string calendar_interval: description: Either `calendar_interval` or `fixed_interval` must be present allOf: - $ref: '#/components/schemas/_types.DurationLarge' fixed_interval: description: Either `calendar_interval` or `fixed_interval` must be present allOf: - $ref: '#/components/schemas/_types.DurationLarge' offset: allOf: - $ref: '#/components/schemas/_types.Duration' time_zone: allOf: - $ref: '#/components/schemas/_types.TimeZone' security.get_service_credentials.NodesCredentialsFileToken: type: object properties: nodes: type: array items: type: string required: - nodes _types.analysis.CharGroupTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - char_group tokenize_on_chars: type: array items: type: string max_token_length: type: number required: - type - tokenize_on_chars _types.aggregations.BucketsDoubleTermsBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.DoubleTermsBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.DoubleTermsBucket' _types.aggregations.UnmappedTermsAggregate: description: Result of a `terms` aggregation when the field is unmapped. `buckets` is always empty. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregateBaseVoid' - type: object _types.aggregations.CardinalityAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: precision_threshold: description: 'A unique count below which counts are expected to be close to accurate. This allows to trade memory for accuracy.' default: 3000.0 type: number rehash: type: boolean execution_hint: description: Mechanism by which cardinality aggregations is run. allOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityExecutionMode' _types.query_dsl.RangeRelation: type: string enum: - within - contains - intersects _types.analysis.KuromojiTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - kuromoji_tokenizer discard_punctuation: type: boolean mode: allOf: - $ref: '#/components/schemas/_types.analysis.KuromojiTokenizationMode' nbest_cost: type: number nbest_examples: type: string user_dictionary: type: string user_dictionary_rules: type: array items: type: string discard_compound_token: type: boolean required: - type - mode _types.analysis.KuromojiTokenizationMode: type: string enum: - normal - search - extended _types.analysis.NGramTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - ngram custom_token_chars: type: string max_gram: type: number min_gram: type: number token_chars: default: [] type: array items: $ref: '#/components/schemas/_types.analysis.TokenChar' required: - type _types.analysis.StemmerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stemmer language: type: string required: - type security._types.ClusterPrivilege: anyOf: - type: string enum: - all - cancel_task - create_snapshot - cross_cluster_replication - cross_cluster_search - delegate_pki - grant_api_key - manage - manage_api_key - manage_autoscaling - manage_behavioral_analytics - manage_ccr - manage_data_frame_transforms - manage_data_stream_global_retention - manage_enrich - manage_esql - manage_ilm - manage_index_templates - manage_inference - manage_ingest_pipelines - manage_logstash_pipelines - manage_ml - manage_oidc - manage_own_api_key - manage_pipeline - manage_reindex - manage_rollup - manage_saml - manage_search_application - manage_search_query_rules - manage_search_synonyms - manage_security - manage_service_account - manage_slm - manage_token - manage_transform - manage_user_profile - manage_watcher - monitor - monitor_data_frame_transforms - monitor_data_stream_global_retention - monitor_enrich - monitor_esql - monitor_inference - monitor_ml - monitor_reindex - monitor_rollup - monitor_snapshot - monitor_stats - monitor_text_structure - monitor_transform - monitor_watcher - none - post_behavioral_analytics_event - read_ccr - read_fleet_secrets - read_ilm - read_pipeline - read_security - read_slm - transport_client - write_connector_secrets - write_fleet_secrets - type: string _types.analysis.CommonGramsTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - common_grams common_words: description: 'A list of tokens. The filter generates bigrams for these tokens. Either this or the `common_words_path` parameter is required.' type: array items: type: string common_words_path: description: 'Path to a file containing a list of tokens. The filter generates bigrams for these tokens. This path must be absolute or relative to the `config` location. The file must be UTF-8 encoded. Each token in the file must be separated by a line break. Either this or the `common_words` parameter is required.' type: string ignore_case: description: If `true`, matches for common words matching are case-insensitive. Defaults to `false`. type: boolean query_mode: description: 'If `true`, the filter excludes the following tokens from the output: - Unigrams for common words - Unigrams for terms followed by common words Defaults to `false`. We recommend enabling this parameter for search analyzers.' type: boolean required: - type _types.query_dsl.DecayFunction: oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.DateDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.NumericDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.GeoDecayFunction' _types.query_dsl.PrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Beginning characters of terms you wish to find in the provided field. type: string case_insensitive: description: 'Allows case insensitive matching of the value with the indexed field values when set to `true`. Default is `false` which means the case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean required: - value _types.analysis.IcuCollationDecomposition: type: string enum: - 'no' - identical _global.search._types.SourceConfig: description: Defines how to fetch a source. Fetching can be disabled entirely, or the source can be filtered. oneOf: - type: boolean - $ref: '#/components/schemas/_global.search._types.SourceFilter' _global.search._types.HighlightBase: type: object properties: type: allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterType' boundary_chars: description: A string that contains each boundary character. default: .,!? \t\n type: string boundary_max_scan: description: How far to scan for boundary characters. default: 20.0 type: number boundary_scanner: description: 'Specifies how to break the highlighted fragments: chars, sentence, or word. Only valid for the unified and fvh highlighters. Defaults to `sentence` for the `unified` highlighter. Defaults to `chars` for the `fvh` highlighter.' allOf: - $ref: '#/components/schemas/_global.search._types.BoundaryScanner' boundary_scanner_locale: description: 'Controls which locale is used to search for sentence and word boundaries. This parameter takes a form of a language tag, for example: `"en-US"`, `"fr-FR"`, `"ja-JP"`.' default: Locale.ROOT type: string force_source: deprecated: true type: boolean fragmenter: description: 'Specifies how text should be broken up in highlight snippets: `simple` or `span`. Only valid for the `plain` highlighter.' default: span allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterFragmenter' fragment_size: description: The size of the highlighted fragment in characters. default: 100.0 type: number highlight_filter: type: boolean highlight_query: description: 'Highlight matches for a query other than the search query. This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' max_fragment_length: type: number max_analyzed_offset: description: 'If set to a non-negative value, highlighting stops at this defined maximum limit. The rest of the text is not processed, thus not highlighted and no error is returned The `max_analyzed_offset` query setting does not override the `index.highlight.max_analyzed_offset` setting, which prevails when it’s set to lower value than the query setting.' type: number no_match_size: description: The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight. default: 0.0 type: number number_of_fragments: description: 'The maximum number of fragments to return. If the number of fragments is set to `0`, no fragments are returned. Instead, the entire field contents are highlighted and returned. This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required. If `number_of_fragments` is `0`, `fragment_size` is ignored.' default: 5.0 type: number options: type: object additionalProperties: type: object order: description: 'Sorts highlighted fragments by score when set to `score`. By default, fragments will be output in the order they appear in the field (order: `none`). Setting this option to `score` will output the most relevant fragments first. Each highlighter applies its own logic to compute relevancy scores.' default: none allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterOrder' phrase_limit: description: 'Controls the number of matching phrases in a document that are considered. Prevents the `fvh` highlighter from analyzing too many phrases and consuming too much memory. When using `matched_fields`, `phrase_limit` phrases per matched field are considered. Raising the limit increases query time and consumes more memory. Only supported by the `fvh` highlighter.' default: 256.0 type: number post_tags: description: 'Use in conjunction with `pre_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags.' type: array items: type: string pre_tags: description: 'Use in conjunction with `post_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags.' type: array items: type: string require_field_match: description: 'By default, only fields that contains a query match are highlighted. Set to `false` to highlight all fields.' default: true type: boolean tags_schema: description: Set to `styled` to use the built-in tag schema. allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterTagsSchema' _types.DurationLarge: description: 'A date histogram interval. Similar to `Duration` with additional units: `w` (week), `M` (month), `q` (quarter) and `y` (year)' type: string _spec_utils.StringifiedEpochTimeUnitMillis: description: 'Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type. Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.' oneOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' - type: string _types.LatLonGeoLocation: type: object properties: lat: description: Latitude type: number lon: description: Longitude type: number required: - lat - lon _types.analysis.UaxEmailUrlTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - uax_url_email max_token_length: type: number required: - type _types.aggregations.PercentilesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: keyed: description: 'By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array. Set to `false` to disable this behavior.' default: true type: boolean percents: description: The percentiles to calculate. oneOf: - type: number - type: array items: type: number hdr: description: Uses the alternative High Dynamic Range Histogram algorithm to calculate percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.HdrMethod' tdigest: description: Sets parameters for the default TDigest algorithm used to calculate percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.TDigest' _types.aggregations.NormalizeMethod: type: string enum: - rescale_0_1 - rescale_0_100 - percent_of_sum - mean - z-score - softmax _types.analysis.IcuNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_normalizer name: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationType' required: - type - name _types.aggregations.FilterAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.SingleBucketAggregateBase' - type: object _types.aggregations.VariableWidthHistogramAggregation: type: object properties: field: description: The name of the field. allOf: - $ref: '#/components/schemas/_types.Field' buckets: description: The target number of buckets. default: 10.0 type: number shard_size: description: 'The number of buckets that the coordinating node will request from each shard. Defaults to `buckets * 50`.' type: number initial_buffer: description: 'Specifies the number of individual documents that will be stored in memory on a shard before the initial bucketing algorithm is run. Defaults to `min(10 * shard_size, 50000)`.' type: number script: allOf: - $ref: '#/components/schemas/_types.Script' _types.aggregations.RateAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: unit: description: 'The interval used to calculate the rate. By default, the interval of the `date_histogram` is used.' allOf: - $ref: '#/components/schemas/_types.aggregations.CalendarInterval' mode: description: How the rate is calculated. default: sum allOf: - $ref: '#/components/schemas/_types.aggregations.RateMode' _types.aggregations.CategorizeTextAggregation: description: 'A multi-bucket aggregation that groups semi-structured text into buckets. Each text field is re-analyzed using a custom analyzer. The resulting tokens are then categorized creating buckets of similarly formatted text values. This aggregation works best with machine generated text like system logs. Only the first 100 analyzed tokens are used to categorize the text.' allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: field: description: The semi-structured text field to categorize. allOf: - $ref: '#/components/schemas/_types.Field' max_unique_tokens: description: 'The maximum number of unique tokens at any position up to max_matched_tokens. Must be larger than 1. Smaller values use less memory and create fewer categories. Larger values will use more memory and create narrower categories. Max allowed value is 100.' default: 50.0 type: number max_matched_tokens: description: 'The maximum number of token positions to match on before attempting to merge categories. Larger values will use more memory and create narrower categories. Max allowed value is 100.' default: 5.0 type: number similarity_threshold: description: 'The minimum percentage of tokens that must match for text to be added to the category bucket. Must be between 1 and 100. The larger the value the narrower the categories. Larger values will increase memory usage and create narrower categories.' default: 50.0 type: number categorization_filters: description: 'This property expects an array of regular expressions. The expressions are used to filter out matching sequences from the categorization field values. You can use this functionality to fine tune the categorization by excluding sequences from consideration when categories are defined. For example, you can exclude SQL statements that appear in your log files. This property cannot be used at the same time as categorization_analyzer. If you only want to define simple regular expression filters that are applied prior to tokenization, setting this property is the easiest method. If you also want to customize the tokenizer or post-tokenization filtering, use the categorization_analyzer property instead and include the filters as pattern_replace character filters.' type: array items: type: string categorization_analyzer: externalDocs: url: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-analyze description: 'The categorization analyzer specifies how the text is analyzed and tokenized before being categorized. The syntax is very similar to that used to define the analyzer in the analyze API. This property cannot be used at the same time as `categorization_filters`.' allOf: - $ref: '#/components/schemas/_types.aggregations.CategorizeTextAnalyzer' shard_size: description: The number of categorization buckets to return from each shard before merging all the results. type: number size: description: The number of buckets to return. default: 10.0 type: number min_doc_count: description: The minimum number of documents in a bucket to be returned to the results. type: number shard_min_doc_count: description: The minimum number of documents in a bucket to be returned from the shard before merging. type: number required: - field security._types.FieldSecurity: type: object properties: except: allOf: - $ref: '#/components/schemas/_types.Fields' grant: allOf: - $ref: '#/components/schemas/_types.Fields' _types.query_dsl.IntervalsFilter: type: object properties: after: description: Query used to return intervals that follow an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' before: description: Query used to return intervals that occur before an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' contained_by: description: Query used to return intervals contained by an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' containing: description: Query used to return intervals that contain an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_contained_by: description: Query used to return intervals that are **not** contained by an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_containing: description: Query used to return intervals that do **not** contain an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_overlapping: description: Query used to return intervals that do **not** overlap with an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' overlapping: description: Query used to return intervals that overlap with an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' script: description: 'Script used to return matching documents. This script must return a boolean value: `true` or `false`.' allOf: - $ref: '#/components/schemas/_types.Script' minProperties: 1 maxProperties: 1 _types.aggregations.TestPopulation: type: object properties: field: description: The field to aggregate. allOf: - $ref: '#/components/schemas/_types.Field' script: allOf: - $ref: '#/components/schemas/_types.Script' filter: description: A filter used to define a set of records to run unpaired t-test on. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - field _types.aggregations.CustomCategorizeTextAnalyzer: type: object properties: char_filter: type: array items: type: string tokenizer: type: string filter: type: array items: type: string security._types.NodeSecurityStats: type: object properties: roles: description: Role statistics. allOf: - $ref: '#/components/schemas/security._types.RolesStats' required: - roles security._types.ClusterNode: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' required: - name _types.aggregations.StringTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.TermsBucketBase' - type: object properties: key: allOf: - $ref: '#/components/schemas/_types.FieldValue' required: - key _types.aggregations.MultiTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: collect_mode: description: Specifies the strategy for data collection. default: breadth_first allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationCollectMode' order: description: 'Specifies the sort order of the buckets. Defaults to sorting by descending document count.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' min_doc_count: description: The minimum number of documents in a bucket for it to be returned. default: 1.0 type: number shard_min_doc_count: description: The minimum number of documents in a bucket on each shard for it to be returned. default: 1.0 type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number show_term_doc_count_error: description: Calculates the doc count error on per term basis. default: false type: boolean size: description: The number of term buckets should be returned out of the overall terms list. default: 10.0 type: number terms: description: The field from which to generate sets of terms. type: array items: $ref: '#/components/schemas/_types.aggregations.MultiTermLookup' required: - terms _global.search._types.Highlight: allOf: - $ref: '#/components/schemas/_global.search._types.HighlightBase' - type: object properties: encoder: allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterEncoder' fields: oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_global.search._types.HighlightField' minProperties: 1 maxProperties: 1 - type: array items: type: object additionalProperties: $ref: '#/components/schemas/_global.search._types.HighlightField' minProperties: 1 maxProperties: 1 required: - fields _types.query_dsl.SpanFieldMaskingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' query: allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - field - query _types.analysis.ShingleTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - shingle filler_token: description: String used in shingles as a replacement for empty positions that do not contain a token. This filler token is only used in shingles, not original unigrams. Defaults to an underscore (`_`). type: string max_shingle_size: description: Maximum number of tokens to concatenate when creating shingles. Defaults to `2`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' min_shingle_size: description: Minimum number of tokens to concatenate when creating shingles. Defaults to `2`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' output_unigrams: description: If `true`, the output includes the original input tokens. If `false`, the output only includes shingles; the original input tokens are removed. Defaults to `true`. type: boolean output_unigrams_if_no_shingles: description: If `true`, the output includes the original input tokens only if no shingles are produced; if shingles are produced, the output only includes shingles. Defaults to `false`. type: boolean token_separator: description: Separator used to concatenate adjacent tokens to form a shingle. Defaults to a space (`" "`). type: string required: - type security.grant_api_key.ApiKeyGrantType: type: string enum: - access_token - password security._types.RoleTemplateScript: type: object properties: source: allOf: - $ref: '#/components/schemas/security._types.RoleTemplateInlineQuery' id: description: The `id` for a stored script. allOf: - $ref: '#/components/schemas/_types.Id' params: description: 'Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.' type: object additionalProperties: type: object lang: description: Specifies the language the script is written in. default: painless allOf: - $ref: '#/components/schemas/_types.ScriptLanguage' options: type: object additionalProperties: type: string indices._types.TranslogDurability: type: string enum: - request - REQUEST - async - ASYNC security.has_privileges.ResourcePrivileges: type: object additionalProperties: $ref: '#/components/schemas/security.has_privileges.Privileges' _types.aggregations.GeoLinePoint: type: object properties: field: description: The name of the geo_point field. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.aggregations.AdjacencyMatrixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: filters: description: 'Filters used to create buckets. At least one filter is required.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' separator: description: Separator used to concatenate filter names. Defaults to &. type: string _types.query_dsl.ScriptQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: script: description: 'Contains a script to run as a query. This script must return a boolean value, `true` or `false`.' allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.query_dsl.RangeQueryBaseDateMath: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: Indicates how the range query matches values for `range` fields. default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. allOf: - $ref: '#/components/schemas/_types.DateMath' gte: description: Greater than or equal to. allOf: - $ref: '#/components/schemas/_types.DateMath' lt: description: Less than. allOf: - $ref: '#/components/schemas/_types.DateMath' lte: description: Less than or equal to. allOf: - $ref: '#/components/schemas/_types.DateMath' indices._types.MappingLimitSettingsTotalFields: type: object properties: limit: description: 'The maximum number of fields in an index. Field and object mappings, as well as field aliases count towards this limit. The limit is in place to prevent mappings and searches from becoming too large. Higher values can lead to performance degradations and memory issues, especially in clusters with a high load or few resources.' default: '1000' oneOf: - type: number - type: string ignore_dynamic_beyond_limit: description: 'This setting determines what happens when a dynamically mapped field would exceed the total fields limit. When set to false (the default), the index request of the document that tries to add a dynamic field to the mapping will fail with the message Limit of total fields [X] has been exceeded. When set to true, the index request will not fail. Instead, fields that would exceed the limit are not added to the mapping, similar to dynamic: false. The fields that were not added to the mapping will be added to the _ignored field.' default: 'false' oneOf: - type: boolean - type: string indices._types.Merge: type: object properties: scheduler: allOf: - $ref: '#/components/schemas/indices._types.MergeScheduler' indices._types.IndexSettingsUnassignedNodeLeft: type: object properties: delayed_timeout: description: 'The amount of time to wait for a node that has left before assuming its shards are permanently missing and starting to allocate replacement replicas.' default: 1m allOf: - $ref: '#/components/schemas/_types.Duration' _types.query_dsl.RangeQuery: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-range-query oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.DateRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.NumberRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.LongNumberRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.TermRangeQuery' _types.Distance: type: string security.delegate_pki.Authentication: type: object properties: username: type: string roles: type: array items: type: string full_name: oneOf: - type: string - type: - string - 'null' email: oneOf: - type: string - type: - string - 'null' token: type: object additionalProperties: type: string metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' enabled: type: boolean authentication_realm: allOf: - $ref: '#/components/schemas/security.delegate_pki.AuthenticationRealm' lookup_realm: allOf: - $ref: '#/components/schemas/security.delegate_pki.AuthenticationRealm' authentication_type: type: string api_key: type: object additionalProperties: type: string required: - username - roles - full_name - email - metadata - enabled - authentication_realm - lookup_realm - authentication_type _types.aggregations.TopMetricsValue: type: object properties: field: description: A field to return as a metric. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.Service: type: string _types.aggregations.CumulativeSumAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object security.delegate_pki.AuthenticationRealm: type: object properties: name: type: string type: type: string domain: type: string required: - name - type _types.analysis.Analyzer: discriminator: propertyName: type mapping: arabic: '#/components/schemas/_types.analysis.ArabicAnalyzer' armenian: '#/components/schemas/_types.analysis.ArmenianAnalyzer' basque: '#/components/schemas/_types.analysis.BasqueAnalyzer' bengali: '#/components/schemas/_types.analysis.BengaliAnalyzer' brazilian: '#/components/schemas/_types.analysis.BrazilianAnalyzer' bulgarian: '#/components/schemas/_types.analysis.BulgarianAnalyzer' catalan: '#/components/schemas/_types.analysis.CatalanAnalyzer' chinese: '#/components/schemas/_types.analysis.ChineseAnalyzer' cjk: '#/components/schemas/_types.analysis.CjkAnalyzer' custom: '#/components/schemas/_types.analysis.CustomAnalyzer' czech: '#/components/schemas/_types.analysis.CzechAnalyzer' danish: '#/components/schemas/_types.analysis.DanishAnalyzer' dutch: '#/components/schemas/_types.analysis.DutchAnalyzer' english: '#/components/schemas/_types.analysis.EnglishAnalyzer' estonian: '#/components/schemas/_types.analysis.EstonianAnalyzer' fingerprint: '#/components/schemas/_types.analysis.FingerprintAnalyzer' finnish: '#/components/schemas/_types.analysis.FinnishAnalyzer' french: '#/components/schemas/_types.analysis.FrenchAnalyzer' galician: '#/components/schemas/_types.analysis.GalicianAnalyzer' german: '#/components/schemas/_types.analysis.GermanAnalyzer' greek: '#/components/schemas/_types.analysis.GreekAnalyzer' hindi: '#/components/schemas/_types.analysis.HindiAnalyzer' hungarian: '#/components/schemas/_types.analysis.HungarianAnalyzer' icu_analyzer: '#/components/schemas/_types.analysis.IcuAnalyzer' indonesian: '#/components/schemas/_types.analysis.IndonesianAnalyzer' irish: '#/components/schemas/_types.analysis.IrishAnalyzer' italian: '#/components/schemas/_types.analysis.ItalianAnalyzer' keyword: '#/components/schemas/_types.analysis.KeywordAnalyzer' kuromoji: '#/components/schemas/_types.analysis.KuromojiAnalyzer' latvian: '#/components/schemas/_types.analysis.LatvianAnalyzer' lithuanian: '#/components/schemas/_types.analysis.LithuanianAnalyzer' nori: '#/components/schemas/_types.analysis.NoriAnalyzer' norwegian: '#/components/schemas/_types.analysis.NorwegianAnalyzer' pattern: '#/components/schemas/_types.analysis.PatternAnalyzer' persian: '#/components/schemas/_types.analysis.PersianAnalyzer' portuguese: '#/components/schemas/_types.analysis.PortugueseAnalyzer' romanian: '#/components/schemas/_types.analysis.RomanianAnalyzer' russian: '#/components/schemas/_types.analysis.RussianAnalyzer' serbian: '#/components/schemas/_types.analysis.SerbianAnalyzer' simple: '#/components/schemas/_types.analysis.SimpleAnalyzer' snowball: '#/components/schemas/_types.analysis.SnowballAnalyzer' sorani: '#/components/schemas/_types.analysis.SoraniAnalyzer' spanish: '#/components/schemas/_types.analysis.SpanishAnalyzer' standard: '#/components/schemas/_types.analysis.StandardAnalyzer' stop: '#/components/schemas/_types.analysis.StopAnalyzer' swedish: '#/components/schemas/_types.analysis.SwedishAnalyzer' thai: '#/components/schemas/_types.analysis.ThaiAnalyzer' turkish: '#/components/schemas/_types.analysis.TurkishAnalyzer' whitespace: '#/components/schemas/_types.analysis.WhitespaceAnalyzer' oneOf: - $ref: '#/components/schemas/_types.analysis.CustomAnalyzer' - $ref: '#/components/schemas/_types.analysis.FingerprintAnalyzer' - $ref: '#/components/schemas/_types.analysis.KeywordAnalyzer' - $ref: '#/components/schemas/_types.analysis.NoriAnalyzer' - $ref: '#/components/schemas/_types.analysis.PatternAnalyzer' - $ref: '#/components/schemas/_types.analysis.SimpleAnalyzer' - $ref: '#/components/schemas/_types.analysis.StandardAnalyzer' - $ref: '#/components/schemas/_types.analysis.StopAnalyzer' - $ref: '#/components/schemas/_types.analysis.WhitespaceAnalyzer' - $ref: '#/components/schemas/_types.analysis.IcuAnalyzer' - $ref: '#/components/schemas/_types.analysis.KuromojiAnalyzer' - $ref: '#/components/schemas/_types.analysis.SnowballAnalyzer' - $ref: '#/components/schemas/_types.analysis.ArabicAnalyzer' - $ref: '#/components/schemas/_types.analysis.ArmenianAnalyzer' - $ref: '#/components/schemas/_types.analysis.BasqueAnalyzer' - $ref: '#/components/schemas/_types.analysis.BengaliAnalyzer' - $ref: '#/components/schemas/_types.analysis.BrazilianAnalyzer' - $ref: '#/components/schemas/_types.analysis.BulgarianAnalyzer' - $ref: '#/components/schemas/_types.analysis.CatalanAnalyzer' - $ref: '#/components/schemas/_types.analysis.ChineseAnalyzer' - $ref: '#/components/schemas/_types.analysis.CjkAnalyzer' - $ref: '#/components/schemas/_types.analysis.CzechAnalyzer' - $ref: '#/components/schemas/_types.analysis.DanishAnalyzer' - $ref: '#/components/schemas/_types.analysis.DutchAnalyzer' - $ref: '#/components/schemas/_types.analysis.EnglishAnalyzer' - $ref: '#/components/schemas/_types.analysis.EstonianAnalyzer' - $ref: '#/components/schemas/_types.analysis.FinnishAnalyzer' - $ref: '#/components/schemas/_types.analysis.FrenchAnalyzer' - $ref: '#/components/schemas/_types.analysis.GalicianAnalyzer' - $ref: '#/components/schemas/_types.analysis.GermanAnalyzer' - $ref: '#/components/schemas/_types.analysis.GreekAnalyzer' - $ref: '#/components/schemas/_types.analysis.HindiAnalyzer' - $ref: '#/components/schemas/_types.analysis.HungarianAnalyzer' - $ref: '#/components/schemas/_types.analysis.IndonesianAnalyzer' - $ref: '#/components/schemas/_types.analysis.IrishAnalyzer' - $ref: '#/components/schemas/_types.analysis.ItalianAnalyzer' - $ref: '#/components/schemas/_types.analysis.LatvianAnalyzer' - $ref: '#/components/schemas/_types.analysis.LithuanianAnalyzer' - $ref: '#/components/schemas/_types.analysis.NorwegianAnalyzer' - $ref: '#/components/schemas/_types.analysis.PersianAnalyzer' - $ref: '#/components/schemas/_types.analysis.PortugueseAnalyzer' - $ref: '#/components/schemas/_types.analysis.RomanianAnalyzer' - $ref: '#/components/schemas/_types.analysis.RussianAnalyzer' - $ref: '#/components/schemas/_types.analysis.SerbianAnalyzer' - $ref: '#/components/schemas/_types.analysis.SoraniAnalyzer' - $ref: '#/components/schemas/_types.analysis.SpanishAnalyzer' - $ref: '#/components/schemas/_types.analysis.SwedishAnalyzer' - $ref: '#/components/schemas/_types.analysis.TurkishAnalyzer' - $ref: '#/components/schemas/_types.analysis.ThaiAnalyzer' _types.DurationValueUnitMillis: allOf: - $ref: '#/components/schemas/_types.UnitMillis' security._types.RemoteClusterPrivileges: description: The subset of cluster level privileges that can be defined for remote clusters. type: object properties: clusters: description: A list of cluster aliases to which the permissions in this entry apply. allOf: - $ref: '#/components/schemas/_types.Names' privileges: description: The cluster level privileges that owners of the role have on the remote cluster. type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivilege' required: - clusters - privileges _types.aggregations.GeoTileGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geotile_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: 'Integer zoom of the key used to define cells/buckets in the results. Values outside of the range [0,29] will be rejected.' default: '7' allOf: - $ref: '#/components/schemas/_types.GeoTilePrecision' shard_size: description: 'Allows for more accurate counting of the top cells returned in the final result the aggregation. Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.' type: number size: description: The maximum number of buckets to return. default: 10000.0 type: number bounds: description: A bounding box to filter the geo-points or geo-shapes in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' _types.analysis.TokenFilterBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.query_dsl.DecayFunctionBase: type: object properties: multi_value_mode: description: Determines how the distance is calculated when a field used for computing the decay contains multiple values. default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.query_dsl.GeoDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBaseGeoLocationDistance' - type: object _types.analysis.ArabicNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - arabic_normalization required: - type _global.search._types.HighlighterFragmenter: type: string enum: - simple - span _types.analysis.BengaliAnalyzer: type: object properties: type: type: string enum: - bengali stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type security._types.User: type: object properties: email: oneOf: - type: string - type: - string - 'null' full_name: oneOf: - $ref: '#/components/schemas/_types.Name' - type: - string - 'null' metadata: allOf: - $ref: '#/components/schemas/_types.Metadata' roles: type: array items: type: string username: allOf: - $ref: '#/components/schemas/_types.Username' enabled: type: boolean profile_uid: allOf: - $ref: '#/components/schemas/security._types.UserProfileId' required: - metadata - roles - username - enabled _types.FieldValue: description: A field value. oneOf: - type: number - type: number - type: string - type: boolean - type: - string - 'null' _types.RankContainer: type: object properties: rrf: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/reciprocal-rank-fusion description: The reciprocal rank fusion parameters allOf: - $ref: '#/components/schemas/_types.RrfRank' minProperties: 1 maxProperties: 1 _types.query_dsl.IntervalsPrefix: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string prefix: description: Beginning characters of terms you wish to find in the top-level field. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - prefix indices._types.SegmentSortOrder: type: string enum: - asc - ASC - desc - DESC _types.aggregations.BucketAggregationBase: description: Base type for bucket aggregations. These aggregations also accept sub-aggregations. allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object security.suggest_user_profiles.TotalUserProfiles: type: object properties: value: type: number relation: allOf: - $ref: '#/components/schemas/_types.RelationName' required: - value - relation _types.aggregations.ChiSquareHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean include_negatives: description: Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset. type: boolean required: - background_is_superset - include_negatives security._types.DataSourcePrivileges: type: object properties: names: description: A list of data source names or wildcard patterns to which the permissions in this entry apply. type: array items: type: string privileges: description: The data source privileges that owners of the role have for the specified data sources. type: array items: $ref: '#/components/schemas/security._types.DataSourcePrivilege' required: - names - privileges _global.search._types.PointInTimeReference: type: object properties: id: allOf: - $ref: '#/components/schemas/_types.Id' keep_alive: allOf: - $ref: '#/components/schemas/_types.Duration' required: - id _types.PipelineName: type: string _types.analysis.LowercaseTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - lowercase required: - type _types.query_dsl.MoreLikeThisQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: externalDocs: url: https://www.elastic.co/docs/manage-data/data-store/text-analysis description: 'The analyzer that is used to analyze the free form text. Defaults to the analyzer associated with the first field in fields.' type: string boost_terms: description: 'Each term in the formed query could be further boosted by their tf-idf score. This sets the boost factor to use when using this feature. Defaults to deactivated (0).' default: 0.0 type: number fail_on_unsupported_field: description: Controls whether the query should fail (throw an exception) if any of the specified fields are not of the supported types (`text` or `keyword`). default: true type: boolean fields: description: 'A list of fields to fetch and analyze the text from. Defaults to the `index.query.default_field` index setting, which has a default value of `*`.' type: array items: $ref: '#/components/schemas/_types.Field' include: description: Specifies whether the input documents should also be included in the search results returned. default: false type: boolean like: description: Specifies free form text and/or a single or multiple documents for which you want to find similar documents. oneOf: - $ref: '#/components/schemas/_types.query_dsl.Like' - type: array items: $ref: '#/components/schemas/_types.query_dsl.Like' max_doc_freq: description: The maximum document frequency above which the terms are ignored from the input document. type: number max_query_terms: description: The maximum number of query terms that can be selected. default: 25.0 type: number max_word_length: description: 'The maximum word length above which the terms are ignored. Defaults to unbounded (`0`).' default: 0.0 type: number min_doc_freq: description: The minimum document frequency below which the terms are ignored from the input document. default: 5.0 type: number minimum_should_match: description: After the disjunctive query has been formed, this parameter controls the number of terms that must match. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' min_term_freq: description: The minimum term frequency below which the terms are ignored from the input document. default: 2.0 type: number min_word_length: description: The minimum word length below which the terms are ignored. default: 0.0 type: number routing: type: string stop_words: description: 'An array of stop words. Any word in this set is ignored.' allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' unlike: description: Used in combination with `like` to exclude documents that match a set of terms. oneOf: - $ref: '#/components/schemas/_types.query_dsl.Like' - type: array items: $ref: '#/components/schemas/_types.query_dsl.Like' version: allOf: - $ref: '#/components/schemas/_types.VersionNumber' version_type: default: '''internal''' allOf: - $ref: '#/components/schemas/_types.VersionType' required: - like indices._types.IndexRoutingAllocationOptions: type: string enum: - all - primaries - new_primaries - none _types.aggregations.CompositeTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object _types.query_dsl.RankFeatureFunctionSigmoid: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: pivot: description: Configurable pivot value so that the result will be less than 0.5. type: number exponent: description: Configurable Exponent. type: number required: - pivot - exponent _types.RescoreVector: type: object properties: oversample: description: Applies the specified oversample factor to k on the approximate kNN search type: number required: - oversample _types.aggregations.TermsAggregationCollectMode: type: string enum: - depth_first - breadth_first _types.analysis.NoriDecompoundMode: type: string enum: - discard - none - mixed _types.aggregations.WeightedAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: format: description: A numeric response formatter. type: string value: description: Configuration for the field that provides the values. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageValue' value_type: allOf: - $ref: '#/components/schemas/_types.aggregations.ValueType' weight: description: Configuration for the field or script that provides the weights. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageValue' _types.AcknowledgedResponseBase: type: object properties: acknowledged: description: For a successful response, this value is always true. On failure, an exception is returned instead. type: boolean required: - acknowledged security.has_privileges_user_profile.PrivilegesCheck: type: object properties: application: type: array items: $ref: '#/components/schemas/security.has_privileges.ApplicationPrivilegesCheck' cluster: description: A list of the cluster privileges that you want to check. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' index: type: array items: $ref: '#/components/schemas/security.has_privileges.IndexPrivilegesCheck' _types.query_dsl.Like: description: Text that we want similar documents for or a lookup to a document's field for the text. oneOf: - type: string - $ref: '#/components/schemas/_types.query_dsl.LikeDocument' _types.RRFRetrieverEntry: description: Either a direct RetrieverContainer (backward compatible) or an RRFRetrieverComponent with weight. oneOf: - $ref: '#/components/schemas/_types.RetrieverContainer' - $ref: '#/components/schemas/_types.RRFRetrieverComponent' _types.aggregations.AggregationContainer: allOf: - type: object properties: aggregations: description: 'Sub-aggregations for this aggregation. Only applies to bucket aggregations.' type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' meta: allOf: - $ref: '#/components/schemas/_types.Metadata' - type: object properties: adjacency_matrix: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-adjacency-matrix-aggregation description: 'A bucket aggregation returning a form of adjacency matrix. The request provides a collection of named filter expressions, similar to the `filters` aggregation. Each bucket in the response represents a non-empty cell in the matrix of intersecting filters.' allOf: - $ref: '#/components/schemas/_types.aggregations.AdjacencyMatrixAggregation' auto_date_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-autodatehistogram-aggregation description: A multi-bucket aggregation similar to the date histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided. allOf: - $ref: '#/components/schemas/_types.aggregations.AutoDateHistogramAggregation' avg: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-avg-aggregation description: A single-value metrics aggregation that computes the average of numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.AverageAggregation' avg_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-avg-bucket-aggregation description: 'A sibling pipeline aggregation which calculates the mean value of a specified metric in a sibling aggregation. The specified metric must be numeric and the sibling aggregation must be a multi-bucket aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.AverageBucketAggregation' boxplot: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-boxplot-aggregation description: A metrics aggregation that computes a box plot of numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.BoxplotAggregation' bucket_script: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-script-aggregation description: A parent pipeline aggregation which runs a script which can perform per bucket computations on metrics in the parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketScriptAggregation' bucket_selector: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-selector-aggregation description: A parent pipeline aggregation which runs a script to determine whether the current bucket will be retained in the parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketSelectorAggregation' bucket_sort: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-sort-aggregation description: A parent pipeline aggregation which sorts the buckets of its parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketSortAggregation' bucket_count_ks_test: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-count-ks-test-aggregation description: A sibling pipeline aggregation which runs a two sample Kolmogorov–Smirnov test ("K-S test") against a provided distribution and the distribution implied by the documents counts in the configured sibling aggregation. x-state: Experimental allOf: - $ref: '#/components/schemas/_types.aggregations.BucketKsAggregation' bucket_correlation: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-correlation-aggregation description: A sibling pipeline aggregation which runs a correlation function on the configured sibling multi-bucket aggregation. x-state: Experimental allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationAggregation' cardinality: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cardinality-aggregation description: A single-value metrics aggregation that calculates an approximate count of distinct values. allOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityAggregation' cartesian_bounds: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cartesian-bounds-aggregation description: A metric aggregation that computes the spatial bounding box containing all values for a Point or Shape field. allOf: - $ref: '#/components/schemas/_types.aggregations.CartesianBoundsAggregation' cartesian_centroid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cartesian-centroid-aggregation description: A metric aggregation that computes the weighted centroid from all coordinate values for point and shape fields. allOf: - $ref: '#/components/schemas/_types.aggregations.CartesianCentroidAggregation' categorize_text: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-categorize-text-aggregation description: A multi-bucket aggregation that groups semi-structured text into buckets. x-state: Experimental allOf: - $ref: '#/components/schemas/_types.aggregations.CategorizeTextAggregation' change_point: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-change-point-aggregation description: 'A sibling pipeline that detects, spikes, dips, and change points in a metric. Given a distribution of values provided by the sibling multi-bucket aggregation, this aggregation indicates the bucket of any spike or dip and/or the bucket at which the largest change in the distribution of values, if they are statistically significant. There must be at least 22 bucketed values. Fewer than 1,000 is preferred.' allOf: - $ref: '#/components/schemas/_types.aggregations.ChangePointAggregation' children: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-children-aggregation description: A single bucket aggregation that selects child documents that have the specified type, as defined in a `join` field. allOf: - $ref: '#/components/schemas/_types.aggregations.ChildrenAggregation' composite: description: 'A multi-bucket aggregation that creates composite buckets from different sources. Unlike the other multi-bucket aggregations, you can use the `composite` aggregation to paginate *all* buckets from a multi-level aggregation efficiently.' allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregation' cumulative_cardinality: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-cumulative-cardinality-aggregation description: A parent pipeline aggregation which calculates the cumulative cardinality in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CumulativeCardinalityAggregation' cumulative_sum: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-cumulative-sum-aggregation description: A parent pipeline aggregation which calculates the cumulative sum of a specified metric in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CumulativeSumAggregation' date_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-datehistogram-aggregation description: 'A multi-bucket values source based aggregation that can be applied on date values or date range values extracted from the documents. It dynamically builds fixed size (interval) buckets over the values.' allOf: - $ref: '#/components/schemas/_types.aggregations.DateHistogramAggregation' date_range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-daterange-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of date ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.DateRangeAggregation' derivative: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-derivative-aggregation description: A parent pipeline aggregation which calculates the derivative of a specified metric in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.DerivativeAggregation' diversified_sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-diversified-sampler-aggregation description: 'A filtering aggregation used to limit any sub aggregations'' processing to a sample of the top-scoring documents. Similar to the `sampler` aggregation, but adds the ability to limit the number of matches that share a common value.' allOf: - $ref: '#/components/schemas/_types.aggregations.DiversifiedSamplerAggregation' extended_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-extendedstats-aggregation description: A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedStatsAggregation' extended_stats_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-extended-stats-bucket-aggregation description: A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedStatsBucketAggregation' frequent_item_sets: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-frequent-item-sets-aggregation description: A bucket aggregation which finds frequent item sets, a form of association rules mining that identifies items that often occur together. allOf: - $ref: '#/components/schemas/_types.aggregations.FrequentItemSetsAggregation' filter: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-filter-aggregation description: A single bucket aggregation that narrows the set of documents to those that match a query. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' filters: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-filters-aggregation description: A multi-bucket aggregation where each bucket contains the documents that match a query. allOf: - $ref: '#/components/schemas/_types.aggregations.FiltersAggregation' geo_bounds: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geobounds-aggregation description: A metric aggregation that computes the geographic bounding box containing all values for a Geopoint or Geoshape field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoBoundsAggregation' geo_centroid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geocentroid-aggregation description: A metric aggregation that computes the weighted centroid from all coordinate values for geo fields. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoCentroidAggregation' geo_distance: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geodistance-aggregation description: 'A multi-bucket aggregation that works on `geo_point` fields. Evaluates the distance of each document value from an origin point and determines the buckets it belongs to, based on ranges defined in the request.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoDistanceAggregation' geohash_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geohashgrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell is labeled using a geohash which is of user-definable precision.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoHashGridAggregation' geo_line: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geo-line description: Aggregates all `geo_point` values within a bucket into a `LineString` ordered by the chosen sort field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineAggregation' geotile_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geotilegrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell corresponds to a map tile as used by many online map sites.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoTileGridAggregation' geohex_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geohexgrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell corresponds to a H3 cell index and is labeled using the H3Index representation.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeohexGridAggregation' global: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-global-aggregation description: 'Defines a single bucket of all the documents within the search execution context. This context is defined by the indices and the document types you’re searching on, but is not influenced by the search query itself.' allOf: - $ref: '#/components/schemas/_types.aggregations.GlobalAggregation' histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-histogram-aggregation description: 'A multi-bucket values source based aggregation that can be applied on numeric values or numeric range values extracted from the documents. It dynamically builds fixed size (interval) buckets over the values.' allOf: - $ref: '#/components/schemas/_types.aggregations.HistogramAggregation' ip_range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-iprange-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of IP ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.IpRangeAggregation' ip_prefix: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-ipprefix-aggregation description: A bucket aggregation that groups documents based on the network or sub-network of an IP address. allOf: - $ref: '#/components/schemas/_types.aggregations.IpPrefixAggregation' inference: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-inference-bucket-aggregation description: A parent pipeline aggregation which loads a pre-trained model and performs inference on the collated result fields from the parent bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.InferenceAggregation' line: allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineAggregation' matrix_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-matrix-stats-aggregation description: 'A numeric aggregation that computes the following statistics over a set of document fields: `count`, `mean`, `variance`, `skewness`, `kurtosis`, `covariance`, and `covariance`.' allOf: - $ref: '#/components/schemas/_types.aggregations.MatrixStatsAggregation' max: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-max-aggregation description: A single-value metrics aggregation that returns the maximum value among the numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.MaxAggregation' max_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-max-bucket-aggregation description: A sibling pipeline aggregation which identifies the bucket(s) with the maximum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s). allOf: - $ref: '#/components/schemas/_types.aggregations.MaxBucketAggregation' median_absolute_deviation: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-median-absolute-deviation-aggregation description: A single-value aggregation that approximates the median absolute deviation of its search results. allOf: - $ref: '#/components/schemas/_types.aggregations.MedianAbsoluteDeviationAggregation' min: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-min-aggregation description: A single-value metrics aggregation that returns the minimum value among numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.MinAggregation' min_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-min-bucket-aggregation description: A sibling pipeline aggregation which identifies the bucket(s) with the minimum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s). allOf: - $ref: '#/components/schemas/_types.aggregations.MinBucketAggregation' missing: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-missing-aggregation description: A field data based single bucket aggregation, that creates a bucket of all documents in the current document set context that are missing a field value (effectively, missing a field or having the configured NULL value set). allOf: - $ref: '#/components/schemas/_types.aggregations.MissingAggregation' moving_avg: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregation' moving_percentiles: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-moving-percentiles-aggregation description: Given an ordered series of percentiles, "slides" a window across those percentiles and computes cumulative percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.MovingPercentilesAggregation' moving_fn: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-movfn-aggregation description: 'Given an ordered series of data, "slides" a window across the data and runs a custom script on each window of data. For convenience, a number of common functions are predefined such as `min`, `max`, and moving averages.' allOf: - $ref: '#/components/schemas/_types.aggregations.MovingFunctionAggregation' multi_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-multi-terms-aggregation description: A multi-bucket value source based aggregation where buckets are dynamically built - one per unique set of values. allOf: - $ref: '#/components/schemas/_types.aggregations.MultiTermsAggregation' nested: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-nested-aggregation description: A special single bucket aggregation that enables aggregating nested documents. allOf: - $ref: '#/components/schemas/_types.aggregations.NestedAggregation' normalize: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-normalize-aggregation description: A parent pipeline aggregation which calculates the specific normalized/rescaled value for a specific bucket value. allOf: - $ref: '#/components/schemas/_types.aggregations.NormalizeAggregation' parent: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-parent-aggregation description: A special single bucket aggregation that selects parent documents that have the specified type, as defined in a `join` field. allOf: - $ref: '#/components/schemas/_types.aggregations.ParentAggregation' percentile_ranks: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-percentile-rank-aggregation description: A multi-value metrics aggregation that calculates one or more percentile ranks over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentileRanksAggregation' percentiles: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-percentile-aggregation description: A multi-value metrics aggregation that calculates one or more percentiles over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentilesAggregation' percentiles_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-percentiles-bucket-aggregation description: A sibling pipeline aggregation which calculates percentiles across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentilesBucketAggregation' range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-range-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.RangeAggregation' rare_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-rare-terms-aggregation description: A multi-bucket value source based aggregation which finds "rare" terms — terms that are at the long-tail of the distribution and are not frequent. allOf: - $ref: '#/components/schemas/_types.aggregations.RareTermsAggregation' rate: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-rate-aggregation description: 'Calculates a rate of documents or a field in each bucket. Can only be used inside a `date_histogram` or `composite` aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.RateAggregation' reverse_nested: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-reverse-nested-aggregation description: 'A special single bucket aggregation that enables aggregating on parent documents from nested documents. Should only be defined inside a `nested` aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.ReverseNestedAggregation' random_sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-random-sampler-aggregation description: 'A single bucket aggregation that randomly includes documents in the aggregated results. Sampling provides significant speed improvement at the cost of accuracy.' x-state: Experimental; Added in 8.1.0 allOf: - $ref: '#/components/schemas/_types.aggregations.RandomSamplerAggregation' sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-sampler-aggregation description: A filtering aggregation used to limit any sub aggregations' processing to a sample of the top-scoring documents. allOf: - $ref: '#/components/schemas/_types.aggregations.SamplerAggregation' scripted_metric: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-scripted-metric-aggregation description: A metric aggregation that uses scripts to provide a metric output. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedMetricAggregation' serial_diff: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-serialdiff-aggregation description: An aggregation that subtracts values in a time series from themselves at different time lags or periods. allOf: - $ref: '#/components/schemas/_types.aggregations.SerialDifferencingAggregation' significant_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-significantterms-aggregation description: Returns interesting or unusual occurrences of terms in a set. allOf: - $ref: '#/components/schemas/_types.aggregations.SignificantTermsAggregation' significant_text: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-significanttext-aggregation description: Returns interesting or unusual occurrences of free-text terms in a set. allOf: - $ref: '#/components/schemas/_types.aggregations.SignificantTextAggregation' stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-stats-aggregation description: A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.StatsAggregation' stats_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-stats-bucket-aggregation description: A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.StatsBucketAggregation' string_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-string-stats-aggregation description: A multi-value metrics aggregation that computes statistics over string values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.StringStatsAggregation' sum: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-sum-aggregation description: A single-value metrics aggregation that sums numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.SumAggregation' sum_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-sum-bucket-aggregation description: A sibling pipeline aggregation which calculates the sum of a specified metric across all buckets in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.SumBucketAggregation' terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-terms-aggregation description: A multi-bucket value source based aggregation where buckets are dynamically built - one per unique value. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregation' time_series: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-time-series-aggregation description: 'The time series aggregation queries data created using a time series index. This is typically data such as metrics or other data streams with a time component, and requires creating an index using the time series mode.' x-state: Experimental allOf: - $ref: '#/components/schemas/_types.aggregations.TimeSeriesAggregation' top_hits: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-top-hits-aggregation description: A metric aggregation that returns the top matching documents per bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.TopHitsAggregation' t_test: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-ttest-aggregation description: A metrics aggregation that performs a statistical hypothesis test in which the test statistic follows a Student’s t-distribution under the null hypothesis on numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.TTestAggregation' top_metrics: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-top-metrics description: A metric aggregation that selects metrics from the document with the largest or smallest sort value. allOf: - $ref: '#/components/schemas/_types.aggregations.TopMetricsAggregation' value_count: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-valuecount-aggregation description: A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.ValueCountAggregation' weighted_avg: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-weight-avg-aggregation description: A single-value metrics aggregation that computes the weighted average of numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageAggregation' variable_width_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-variablewidthhistogram-aggregation description: A multi-bucket aggregation similar to the histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided. allOf: - $ref: '#/components/schemas/_types.aggregations.VariableWidthHistogramAggregation' minProperties: 1 maxProperties: 1 _types.analysis.SnowballLanguage: type: string enum: - Arabic - Armenian - Basque - Catalan - Danish - Dutch - English - Estonian - Finnish - French - German - German2 - Hungarian - Italian - Irish - Kp - Lithuanian - Lovins - Norwegian - Porter - Portuguese - Romanian - Russian - Serbian - Spanish - Swedish - Turkish _types.MinimumShouldMatch: description: The minimum number of terms that should match as integer, percentage or range oneOf: - type: number - type: string _types.aggregations.FrequentItemSetsField: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' exclude: description: 'Values to exclude. Can be regular expression strings or arrays of strings of exact terms.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' include: description: 'Values to include. Can be regular expression strings or arrays of strings of exact terms.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' required: - field _types.aggregations.CategorizeTextAnalyzer: oneOf: - type: string - $ref: '#/components/schemas/_types.aggregations.CustomCategorizeTextAnalyzer' _types.query_dsl.ScriptScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: min_score: description: Documents with a score lower than this floating point number are excluded from the search results. type: number query: description: Query used to return documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' script: description: 'Script used to compute the score of documents returned by the query. Important: final relevance scores from the `script_score` query cannot be negative.' allOf: - $ref: '#/components/schemas/_types.Script' required: - query - script _types.Username: type: string _types.aggregations.ReverseNestedAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: path: description: 'Defines the nested object field that should be joined back to. The default is empty, which means that it joins back to the root/main document level.' allOf: - $ref: '#/components/schemas/_types.Field' _types.NodeStatistics: description: Contains statistics about the number of nodes selected by the request. type: object properties: failures: type: array items: $ref: '#/components/schemas/_types.ErrorCause' total: description: Total number of nodes selected by the request. type: number successful: description: Number of nodes that responded successfully to the request. type: number failed: description: Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response. type: number required: - total - successful - failed _types.analysis.Tokenizer: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/tokenizer-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.TokenizerDefinition' _types.aggregations.GeoHashGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: bounds: description: The bounding box to filter the points in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geohash_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: The string length of the geohashes used to define cells/buckets in the results. default: '5' allOf: - $ref: '#/components/schemas/_types.GeoHashPrecision' shard_size: description: 'Allows for more accurate counting of the top cells returned in the final result the aggregation. Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.' type: number size: description: The maximum number of geohash buckets to return. default: 10000.0 type: number _types.query_dsl.NestedQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: Indicates whether to ignore an unmapped path and not return any documents instead of an error. default: false type: boolean inner_hits: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-inner-hits description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' path: description: Path to the nested object you wish to search. allOf: - $ref: '#/components/schemas/_types.Field' query: description: Query you wish to run on nested objects in the path. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: How scores for matching child objects affect the root parent document’s relevance score. default: '''avg''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ChildScoreMode' required: - path - query _types.query_dsl.TermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: description: Term you wish to find in the provided field. allOf: - $ref: '#/components/schemas/_types.FieldValue' case_insensitive: description: 'Allows case insensitive matching of the value with the indexed field values when set to `true`. When `false`, the case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean required: - value indices._types.IndexRoutingAllocationInclude: type: object properties: _tier_preference: type: string _id: allOf: - $ref: '#/components/schemas/_types.Id' _types.analysis.StandardTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - standard max_token_length: type: number required: - type _types.aggregations.EwmaModelSettings: type: object properties: alpha: type: number _types.aggregations.FormatMetricAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: format: type: string _types.aggregations.ExtendedBoundsFieldDateMath: type: object properties: max: description: Maximum value for the bound. allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' min: description: Minimum value for the bound. allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' _types.query_dsl.GeoGridQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: geotile: allOf: - $ref: '#/components/schemas/_types.GeoTile' geohash: allOf: - $ref: '#/components/schemas/_types.GeoHash' geohex: allOf: - $ref: '#/components/schemas/_types.GeoHexCell' minProperties: 1 maxProperties: 1 _types.DistanceUnit: type: string enum: - in - ft - yd - mi - nmi - km - m - cm - mm _types.query_dsl.NumberRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBasedouble' - type: object _types.aggregations.AverageBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.aggregations.CardinalityExecutionMode: type: string enum: - global_ordinals - segment_ordinals - direct - save_memory_heuristic - save_time_heuristic security._types.ApiKeyType: type: string enum: - rest - cross_cluster security._types.IndexPrivilege: anyOf: - type: string enum: - all - auto_configure - create - create_doc - create_index - create_view - cross_cluster_replication - cross_cluster_replication_internal - delete - delete_index - delete_view - index - maintenance - manage - manage_data_stream_lifecycle - manage_follow_index - manage_ilm - manage_leader_index - manage_view - monitor - none - read - read_cross_cluster - read_view_metadata - view_index_metadata - write - type: string _types.aggregations.RateMode: type: string enum: - sum - value_count _types.aggregations.CompositeGeoTileGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: precision: type: number bounds: allOf: - $ref: '#/components/schemas/_types.GeoBounds' _types.analysis.BengaliNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - bengali_normalization required: - type _types.aggregations.DerivativeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.aggregations.LongTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.TermsBucketBase' - type: object properties: key: type: number key_as_string: type: string required: - key _types.aggregations.CompositeHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: interval: type: number required: - interval indices._types.IndexRoutingAllocation: type: object properties: enable: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingAllocationOptions' include: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingAllocationInclude' initial_recovery: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingAllocationInitialRecovery' disk: allOf: - $ref: '#/components/schemas/indices._types.IndexRoutingAllocationDisk' _types.aggregations.BucketsStringTermsBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.StringTermsBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.StringTermsBucket' _types.aggregations.MultiBucketAggregateBaseLongTermsBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsLongTermsBucket' required: - buckets _types.aggregations.HdrMethod: type: object properties: number_of_significant_value_digits: description: Specifies the resolution of values for the histogram in number of significant digits. type: number _types.analysis.CjkWidthTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - cjk_width required: - type _types.VersionNumber: type: number _global.search._types.TrackHits: description: 'Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.' oneOf: - type: boolean - type: number _types.query_dsl.FunctionScoreMode: type: string enum: - multiply - sum - avg - first - max - min indices._types.IndexCheckOnStartup: type: string enum: - 'true' - 'false' - checksum _types.analysis.ReverseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - reverse required: - type security.create_service_token.Token: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' value: type: string required: - name - value _types.aggregations.BucketsVoid: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_spec_utils.Void' - type: array items: $ref: '#/components/schemas/_spec_utils.Void' _types.query_dsl.GeoValidationMethod: type: string enum: - coerce - ignore_malformed - strict _types.DFRBasicModel: type: string enum: - be - d - g - if - in - ine - p _types.aggregations.BucketCorrelationFunctionCountCorrelation: type: object properties: indicator: description: The indicator with which to correlate the configured `bucket_path` values. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator' required: - indicator _types.analysis.IcuAnalyzer: type: object properties: type: type: string enum: - icu_analyzer method: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationType' mode: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationMode' required: - type - method - mode indices._types.IndexRoutingAllocationInitialRecovery: type: object properties: _id: allOf: - $ref: '#/components/schemas/_types.Id' _types.query_dsl.LongNumberRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBaselong' - type: object indices._types.IndexVersioning: type: object properties: created: allOf: - $ref: '#/components/schemas/_types.VersionString' created_string: type: string _types.analysis.ClassicTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - classic max_token_length: type: number required: - type security.get_token.AccessTokenGrantType: type: string enum: - password - client_credentials - _kerberos - refresh_token _types.Duration: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/api-conventions#time-units description: 'A duration. Units can be `nanos`, `micros`, `ms` (milliseconds), `s` (seconds), `m` (minutes), `h` (hours) and `d` (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.' oneOf: - type: string - type: string enum: - '-1' - type: string enum: - '0' _spec_utils.Stringifiedinteger: description: 'Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type. Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.' oneOf: - type: number - type: string _types.query_dsl.DistanceFeatureQueryBaseDateMathDuration: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' allOf: - $ref: '#/components/schemas/_types.DateMath' pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' allOf: - $ref: '#/components/schemas/_types.Duration' field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field indices._types.SettingsSimilarityBm25: type: object properties: type: type: string enum: - BM25 b: type: number discount_overlaps: type: boolean k1: type: number required: - type _types.query_dsl.TermRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBasestring' - type: object _types.aggregations.DateRangeExpression: type: object properties: from: description: Start of the range (inclusive). allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' key: description: Custom key to return the range with. type: string to: description: End of the range (exclusive). allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' _types.aggregations.BucketsCompositeBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.CompositeBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.CompositeBucket' _types.aggregations.ValueType: type: string enum: - string - long - double - number - date - date_nanos - ip - numeric - geo_point - boolean indices._types.SettingsAnalyze: type: object properties: max_token_count: default: '10000' allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' _global.search._types.Suggester: type: object properties: text: description: Global suggest text, to avoid repetition when the same text is used in several suggesters type: string security._types.ApiKey: type: object properties: id: description: Id for the API key allOf: - $ref: '#/components/schemas/_types.Id' name: description: Name of the API key. allOf: - $ref: '#/components/schemas/_types.Name' type: description: The type of the API key (e.g. `rest` or `cross_cluster`). x-state: Generally available; Added in 8.10.0 allOf: - $ref: '#/components/schemas/security._types.ApiKeyType' creation: description: Creation time for the API key in milliseconds. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' expiration: description: Expiration time for the API key in milliseconds. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' invalidated: description: 'Invalidation status for the API key. If the key has been invalidated, it has a value of `true`. Otherwise, it is `false`.' type: boolean invalidation: description: If the key has been invalidated, invalidation time in milliseconds. x-state: Generally available; Added in 8.12.0 allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' username: description: Principal for which this API key was created allOf: - $ref: '#/components/schemas/_types.Username' realm: description: Realm name of the principal for which this API key was created. type: string realm_type: description: Realm type of the principal for which this API key was created x-state: Generally available; Added in 8.14.0 type: string metadata: description: Metadata of the API key x-state: Generally available; Added in 7.13.0 allOf: - $ref: '#/components/schemas/_types.Metadata' role_descriptors: description: 'The role descriptors assigned to this API key when it was created or last updated. An empty role descriptor means the API key inherits the owner user’s permissions.' type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' limited_by: description: 'The owner user’s permissions associated with the API key. It is a point-in-time snapshot captured at creation and subsequent updates. An API key’s effective permissions are an intersection of its assigned privileges and the owner user’s permissions.' x-state: Generally available; Added in 8.5.0 type: array items: type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' access: description: 'The access granted to cross-cluster API keys. The access is composed of permissions for cross cluster search and cross cluster replication. At least one of them must be specified. When specified, the new access assignment fully replaces the previously assigned access.' x-state: Generally available; Added in 8.10.0 allOf: - $ref: '#/components/schemas/security._types.Access' certificate_identity: description: 'The certificate identity associated with a cross-cluster API key. Restricts the API key to connections authenticated by a specific TLS certificate. Only applicable to cross-cluster API keys.' x-state: Generally available; Added in 9.3.0 type: string profile_uid: description: The profile uid for the API key owner principal, if requested and if it exists x-state: Generally available; Added in 8.14.0 type: string _sort: description: Sorting values when using the `sort` parameter with the `security.query_api_keys` API. allOf: - $ref: '#/components/schemas/_types.SortResults' required: - id - name - type - creation - invalidated - username - realm - metadata _types.aggregations.GeoBoundsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: wrap_longitude: description: Specifies whether the bounding box should be allowed to overlap the international date line. default: true type: boolean _types.analysis.SerbianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - serbian_normalization required: - type _types.LinearRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retrievers: description: Inner retrievers. type: array items: $ref: '#/components/schemas/_types.InnerRetriever' rank_window_size: type: number query: type: string fields: type: array items: type: string normalizer: allOf: - $ref: '#/components/schemas/_types.ScoreNormalizer' _types.analysis.CzechStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - czech_stem required: - type _types.analysis.LowercaseTokenFilterLanguages: type: string enum: - greek - irish - turkish security.get_token.UserRealm: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' type: type: string required: - name - type security._types.SecuritySettings: type: object properties: index: allOf: - $ref: '#/components/schemas/indices._types.IndexSettings' _types.LookupQueryVectorBuilder: type: object properties: id: description: The ID of the document to fetch the vector from type: string index: description: The name of the index to fetch the document from type: string path: description: The name of the field containing the vector type: string routing: description: The routing value to use when fetching the document type: string required: - id - index - path _types.query_dsl.MatchNoneQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object _types.query_dsl.UntypedDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBase' - type: object _types.aggregations.SimpleMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - simple settings: allOf: - $ref: '#/components/schemas/_types.EmptyObject' required: - model - settings _types.mapping.OnScriptError: type: string enum: - fail - continue _types.query_dsl.ZeroTermsQuery: type: string enum: - all - none _types.analysis.GreekAnalyzer: type: object properties: type: type: string enum: - greek stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.RetrieverBase: type: object properties: filter: description: Query to filter the documents that can match. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' min_score: description: Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. type: number _name: description: Retriever name. type: string _spec_utils.NullValue: description: 'A `null` value that is to be interpreted as an actual value, unless other uses of `null` that are equivalent to a missing value. It is used for exemple in settings, where using the `NullValue` for a setting will reset it to its default value.' type: - string - 'null' _types.aggregations.TDigest: type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' _types.analysis.GermanNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - german_normalization required: - type _types.VersionType: type: string enum: - internal - external - external_gte security._types.RoleDescriptor: type: object properties: cluster: description: A list of cluster privileges. These privileges define the cluster level actions that API keys are able to execute. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' indices: description: A list of indices permissions entries. type: array items: $ref: '#/components/schemas/security._types.IndicesPrivileges' remote_indices: description: A list of indices permissions for remote clusters. x-state: Generally available; Added in 8.14.0 type: array items: $ref: '#/components/schemas/security._types.RemoteIndicesPrivileges' remote_cluster: description: 'A list of cluster permissions for remote clusters. NOTE: This is limited a subset of the cluster permissions.' x-state: Generally available; Added in 8.15.0 type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivileges' global: description: An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. oneOf: - type: array items: $ref: '#/components/schemas/security._types.GlobalPrivilege' - $ref: '#/components/schemas/security._types.GlobalPrivilege' applications: description: A list of application privilege entries type: array items: $ref: '#/components/schemas/security._types.ApplicationPrivileges' metadata: description: Optional meta-data. Within the metadata object, keys that begin with `_` are reserved for system usage. allOf: - $ref: '#/components/schemas/_types.Metadata' run_as: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/submitting-requests-on-behalf-of-other-users description: 'A list of users that the API keys can impersonate. NOTE: In Elastic Cloud Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty `run_as` field, but a non-empty list will be rejected.' type: array items: type: string description: description: Optional description of the role descriptor type: string restriction: description: Restriction for when the role descriptor is allowed to be effective. allOf: - $ref: '#/components/schemas/security._types.Restriction' transient_metadata: type: object additionalProperties: type: object _types.analysis.ItalianAnalyzer: type: object properties: type: type: string enum: - italian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.SettingsSimilarityLmd: type: object properties: type: type: string enum: - LMDirichlet mu: type: number required: - type security._types.UserProfileId: type: string _types.Namespace: type: string _types.StandardRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: query: description: Defines a query to retrieve a set of top documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' search_after: description: Defines a search after object parameter used for pagination. allOf: - $ref: '#/components/schemas/_types.SortResults' terminate_after: description: Maximum number of documents to collect for each shard. type: number sort: description: A sort object that that specifies the order of matching documents. allOf: - $ref: '#/components/schemas/_types.Sort' collapse: description: Collapses the top documents by a specified key into a single top document per key. allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' _types.aggregations.GeoDistanceAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: distance_type: description: The distance calculation type. default: arc allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' field: description: A field of type `geo_point` used to evaluate the distance. allOf: - $ref: '#/components/schemas/_types.Field' origin: description: The origin used to evaluate the distance. allOf: - $ref: '#/components/schemas/_types.GeoLocation' ranges: description: An array of ranges used to bucket documents. type: array items: $ref: '#/components/schemas/_types.aggregations.AggregationRange' unit: description: The distance unit. default: m allOf: - $ref: '#/components/schemas/_types.DistanceUnit' _types.aggregations.RareTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: exclude: description: Terms that should be excluded from the aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' field: description: The field from which to return rare terms. allOf: - $ref: '#/components/schemas/_types.Field' include: description: Terms that should be included in the aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' max_doc_count: description: The maximum number of documents a term should appear in. default: 1.0 type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' precision: description: 'The precision of the internal CuckooFilters. Smaller precision leads to better approximation, but higher memory usage.' default: 0.001 type: number value_type: type: string _types.aggregations.ExtendedBoundsdouble: type: object properties: max: description: Maximum value for the bound. type: number min: description: Minimum value for the bound. type: number security.get_token.AuthenticationProvider: type: object properties: type: type: string name: allOf: - $ref: '#/components/schemas/_types.Name' required: - type - name _types.aggregations.BucketScriptAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script to run for this aggregation. allOf: - $ref: '#/components/schemas/_types.Script' indices._types.MappingLimitSettings: description: Mapping Limit Settings type: object properties: coerce: type: boolean total_fields: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsTotalFields' depth: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsDepth' nested_fields: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsNestedFields' nested_objects: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsNestedObjects' field_name_length: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsFieldNameLength' dimension_fields: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsDimensionFields' source: allOf: - $ref: '#/components/schemas/indices._types.MappingLimitSettingsSourceFields' ignore_malformed: oneOf: - type: boolean - type: string _types.aggregations.TermsInclude: oneOf: - type: string - type: array items: type: string - $ref: '#/components/schemas/_types.aggregations.TermsPartition' _types.aggregations.LinearMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - linear settings: allOf: - $ref: '#/components/schemas/_types.EmptyObject' required: - model - settings indices._types.SettingsSimilarity: discriminator: propertyName: type mapping: BM25: '#/components/schemas/indices._types.SettingsSimilarityBm25' DFI: '#/components/schemas/indices._types.SettingsSimilarityDfi' DFR: '#/components/schemas/indices._types.SettingsSimilarityDfr' IB: '#/components/schemas/indices._types.SettingsSimilarityIb' LMDirichlet: '#/components/schemas/indices._types.SettingsSimilarityLmd' LMJelinekMercer: '#/components/schemas/indices._types.SettingsSimilarityLmj' boolean: '#/components/schemas/indices._types.SettingsSimilarityBoolean' scripted: '#/components/schemas/indices._types.SettingsSimilarityScripted' oneOf: - $ref: '#/components/schemas/indices._types.SettingsSimilarityBm25' - $ref: '#/components/schemas/indices._types.SettingsSimilarityBoolean' - $ref: '#/components/schemas/indices._types.SettingsSimilarityDfi' - $ref: '#/components/schemas/indices._types.SettingsSimilarityDfr' - $ref: '#/components/schemas/indices._types.SettingsSimilarityIb' - $ref: '#/components/schemas/indices._types.SettingsSimilarityLmd' - $ref: '#/components/schemas/indices._types.SettingsSimilarityLmj' - $ref: '#/components/schemas/indices._types.SettingsSimilarityScripted' security.has_privileges.Privileges: type: object additionalProperties: type: boolean _types.aggregations.ValueCountAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormattableMetricAggregation' - type: object _types.analysis.EdgeNGramSide: type: string enum: - front - back _types.query_dsl.HasChildQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: Indicates whether to ignore an unmapped `type` and not return any documents instead of an error. default: false type: boolean inner_hits: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-inner-hits description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' max_children: description: 'Maximum number of child documents that match the query allowed for a returned parent document. If the parent document exceeds this limit, it is excluded from the search results.' type: number min_children: description: 'Minimum number of child documents that match the query required to match the query for a returned parent document. If the parent document does not meet this limit, it is excluded from the search results.' type: number query: description: 'Query you wish to run on child documents of the `type` field. If a child document matches the search, the query returns the parent document.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: Indicates how scores for matching child documents affect the root parent document’s relevance score. default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ChildScoreMode' type: description: Name of the child relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' required: - query - type _types.analysis.ScandinavianFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - scandinavian_folding required: - type _types.query_dsl.DateDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBaseDateMathDuration' - type: object indices._types.SettingsSearch: type: object properties: idle: allOf: - $ref: '#/components/schemas/indices._types.SearchIdle' slowlog: allOf: - $ref: '#/components/schemas/indices._types.SlowlogSettings' security._types.RoleMappingRule: type: object properties: any: type: array items: $ref: '#/components/schemas/security._types.RoleMappingRule' all: type: array items: $ref: '#/components/schemas/security._types.RoleMappingRule' field: type: object additionalProperties: oneOf: - $ref: '#/components/schemas/_types.FieldValue' - type: array items: $ref: '#/components/schemas/_types.FieldValue' minProperties: 1 maxProperties: 1 except: allOf: - $ref: '#/components/schemas/security._types.RoleMappingRule' minProperties: 1 maxProperties: 1 _types.aggregations.CardinalityAggregate: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: value: type: number required: - value _types.aggregations.GlobalAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object _types.aggregations.Aggregation: type: object _types.analysis.StandardAnalyzer: type: object properties: type: type: string enum: - standard max_token_length: description: 'The maximum token length. If a token is seen that exceeds this length then it is split at `max_token_length` intervals. Defaults to `255`.' default: 255.0 type: number stopwords: description: 'A pre-defined stop words list like `_english_` or an array containing a list of stop words. Defaults to `_none_`.' default: _none_ allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: The path to a file containing stop words. type: string required: - type _types.analysis.LowercaseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - lowercase language: description: Language-specific lowercase token filter to use. allOf: - $ref: '#/components/schemas/_types.analysis.LowercaseTokenFilterLanguages' required: - type _types.query_dsl.SpanOrQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: clauses: description: Array of one or more other span type queries. type: array items: $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - clauses _types.aggregations.TimeSeriesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: size: description: The maximum number of results to return. default: 10000.0 type: number keyed: description: Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array. type: boolean security._types.UserProfileWithMetadata: allOf: - $ref: '#/components/schemas/security._types.UserProfile' - type: object properties: last_synchronized: type: number _doc: allOf: - $ref: '#/components/schemas/security._types.UserProfileHitMetadata' required: - last_synchronized - _doc _types.query_dsl.BoolQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: filter: description: 'The clause (query) must appear in matching documents. However, unlike `must`, the score of the query will be ignored.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' minimum_should_match: description: Specifies the number or percentage of `should` clauses returned documents must match. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' must: description: The clause (query) must appear in matching documents and will contribute to the score. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' must_not: description: 'The clause (query) must not appear in the matching documents. Because scoring is ignored, a score of `0` is returned for all documents.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' should: description: The clause (query) should appear in the matching document. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' _types.SpecifiedDocument: type: object properties: index: allOf: - $ref: '#/components/schemas/_types.IndexName' id: allOf: - $ref: '#/components/schemas/_types.Id' required: - id security.query_api_keys.ApiKeyQueryContainer: type: object properties: bool: description: Matches documents matching boolean combinations of other queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoolQuery' exists: description: Returns documents that contain an indexed value for a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.ExistsQuery' ids: description: 'Returns documents based on their IDs. This query uses document IDs stored in the `_id` field.' allOf: - $ref: '#/components/schemas/_types.query_dsl.IdsQuery' match: description: 'Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchQuery' minProperties: 1 maxProperties: 1 match_all: description: Matches all documents, giving them all a `_score` of 1.0. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchAllQuery' prefix: description: Returns documents that contain a specific prefix in a provided field. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.PrefixQuery' minProperties: 1 maxProperties: 1 range: description: Returns documents that contain terms within a provided range. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RangeQuery' minProperties: 1 maxProperties: 1 simple_query_string: description: Returns documents based on a provided query string, using a parser with a limited but fault-tolerant syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringQuery' term: description: 'Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field''s value, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermQuery' minProperties: 1 maxProperties: 1 terms: description: 'Returns documents that contain one or more exact terms in a provided field. To return a document, one or more terms must exactly match a field value, including whitespace and capitalization.' allOf: - $ref: '#/components/schemas/_types.query_dsl.TermsQuery' wildcard: description: Returns documents that contain terms matching a wildcard pattern. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WildcardQuery' minProperties: 1 maxProperties: 1 minProperties: 1 maxProperties: 1 _types.query_dsl.SimpleQueryStringQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert text in the query string into tokens. type: string analyze_wildcard: description: If `true`, the query attempts to analyze wildcard terms in the query string. default: false type: boolean auto_generate_synonyms_phrase_query: description: If `true`, the parser creates a match_phrase query for each multi-position token. default: true type: boolean default_operator: description: Default boolean logic used to interpret text in the query string if no operators are specified. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' fields: description: 'Array of fields you wish to search. Accepts wildcard expressions. You also can boost relevance scores for matches to particular fields using a caret (`^`) notation. Defaults to the `index.query.default_field index` setting, which has a default value of `*`.' type: array items: $ref: '#/components/schemas/_types.Field' flags: description: List of enabled operators for the simple query string syntax. default: ALL allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringFlags' fuzzy_max_expansions: description: Maximum number of terms to which the query expands for fuzzy matching. default: 50.0 type: number fuzzy_prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). type: boolean lenient: description: If `true`, format-based errors, such as providing a text value for a numeric field, are ignored. default: false type: boolean minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' query: description: Query string in the simple query string syntax you wish to parse and use for search. type: string quote_field_suffix: description: Suffix appended to quoted text in the query string. type: string required: - query _types.aggregations.AggregateBase: type: object properties: meta: allOf: - $ref: '#/components/schemas/_types.Metadata' indices._types.IndexingPressureMemory: type: object properties: limit: description: 'Number of outstanding bytes that may be consumed by indexing requests. When this limit is reached or exceeded, the node will reject new coordinating and primary operations. When replica operations consume 1.5x this limit, the node will reject new replica operations. Defaults to 10% of the heap.' type: number _types.aggregations.InferenceConfigContainer: type: object properties: regression: description: Regression configuration for inference. allOf: - $ref: '#/components/schemas/ml._types.RegressionInferenceOptions' classification: description: Classification configuration for inference. allOf: - $ref: '#/components/schemas/ml._types.ClassificationInferenceOptions' minProperties: 1 maxProperties: 1 _types.SortCombinations: oneOf: - $ref: '#/components/schemas/_types.Field' - $ref: '#/components/schemas/_types.SortOptions' _types.aggregations.GapPolicy: type: string enum: - skip - insert_zeros - keep_values _types.analysis.LengthTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - length max: description: Maximum character length of a token. Longer tokens are excluded from the output. Defaults to `Integer.MAX_VALUE`, which is `2^31-1` or `2147483647`. type: number min: description: Minimum character length of a token. Shorter tokens are excluded from the output. Defaults to `0`. type: number required: - type _types.analysis.FlattenGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - flatten_graph required: - type _types.aggregations.CompositeBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.MultiBucketBase' - type: object properties: key: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregateKey' required: - key _types.analysis.PatternReplaceTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - pattern_replace all: description: If `true`, all substrings matching the pattern parameter’s regular expression are replaced. If `false`, the filter replaces only the first matching substring in each token. Defaults to `true`. type: boolean flags: type: string pattern: description: Regular expression, written in Java’s regular expression syntax. The filter replaces token substrings matching this pattern with the substring in the `replacement` parameter. type: string replacement: description: Replacement substring. Defaults to an empty substring (`""`). type: string required: - type - pattern _types.query_dsl.RangeQueryBasestring: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: Indicates how the range query matches values for `range` fields. default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: string gte: description: Greater than or equal to. type: string lt: description: Less than. type: string lte: description: Less than or equal to. type: string _types.query_dsl.ScriptScoreFunction: type: object properties: script: description: A script that computes a score. allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.aggregations.DiversifiedSamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: execution_hint: description: The type of value used for de-duplication. default: global_ordinals allOf: - $ref: '#/components/schemas/_types.aggregations.SamplerAggregationExecutionHint' max_docs_per_value: description: Limits how many documents are permitted per choice of de-duplicating value. default: 1.0 type: number script: allOf: - $ref: '#/components/schemas/_types.Script' shard_size: description: Limits how many top-scoring documents are collected in the sample processed on each shard. default: 100.0 type: number field: description: The field used to provide values used for de-duplication. allOf: - $ref: '#/components/schemas/_types.Field' _types.aggregations.NestedAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: path: description: The path to the field of type `nested`. allOf: - $ref: '#/components/schemas/_types.Field' _types.analysis.CjkBigramIgnoredScript: type: string enum: - han - hangul - hiragana - katakana indices._types.IndexSegmentSort: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Fields' order: oneOf: - $ref: '#/components/schemas/indices._types.SegmentSortOrder' - type: array items: $ref: '#/components/schemas/indices._types.SegmentSortOrder' mode: oneOf: - $ref: '#/components/schemas/indices._types.SegmentSortMode' - type: array items: $ref: '#/components/schemas/indices._types.SegmentSortMode' missing: oneOf: - $ref: '#/components/schemas/indices._types.SegmentSortMissing' - type: array items: $ref: '#/components/schemas/indices._types.SegmentSortMissing' _types.aggregations.CalendarInterval: type: string enum: - second - 1s - minute - 1m - hour - 1h - day - 1d - week - 1w - month - 1M - quarter - 1q - year - 1y _types.ScriptSource: oneOf: - type: string - $ref: '#/components/schemas/_global.search._types.SearchRequestBody' _types.analysis.KeepWordsTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keep keep_words: description: 'List of words to keep. Only tokens that match words in this list are included in the output. Either this parameter or `keep_words_path` must be specified.' type: array items: type: string keep_words_case: description: If `true`, lowercase all keep words. Defaults to `false`. type: boolean keep_words_path: description: 'Path to a file that contains a list of words to keep. Only tokens that match words in this list are included in the output. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each word in the file must be separated by a line break. Either this parameter or `keep_words` must be specified.' type: string required: - type _types.analysis.NorwegianAnalyzer: type: object properties: type: type: string enum: - norwegian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.Refresh: type: string enum: - 'true' - 'false' - wait_for _types.aggregations.CompositeAggregateKey: type: object additionalProperties: $ref: '#/components/schemas/_types.FieldValue' _types.Normalization: type: string enum: - 'no' - h1 - h2 - h3 - z _types.analysis.RemoveDuplicatesTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - remove_duplicates required: - type _types.query_dsl.MatchQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean cutoff_frequency: deprecated: true type: number fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text query value for a numeric field, are ignored. default: false type: boolean max_expansions: description: Maximum number of terms to which the query will expand. default: 50.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: Boolean logic used to interpret text in the query value. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number query: description: Text, number, boolean value or date you wish to find in the provided field. oneOf: - type: string - type: number - type: boolean zero_terms_query: description: Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter. default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.aggregations.CumulativeCardinalityAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.analysis.EdgeNGramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - edge_ngram max_gram: description: Maximum character length of a gram. For custom token filters, defaults to `2`. For the built-in edge_ngram filter, defaults to `1`. type: number min_gram: description: Minimum character length of a gram. Defaults to `1`. type: number side: description: Indicates whether to truncate tokens from the `front` or `back`. Defaults to `front`. allOf: - $ref: '#/components/schemas/_types.analysis.EdgeNGramSide' preserve_original: description: Emits original token when set to `true`. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type indices._types.SettingsSimilarityDfi: type: object properties: type: type: string enum: - DFI independence_measure: allOf: - $ref: '#/components/schemas/_types.DFIIndependenceMeasure' required: - type - independence_measure _types.DFRAfterEffect: type: string enum: - 'no' - b - l _types.query_dsl.SimpleQueryStringFlag: type: string enum: - NONE - AND - NOT - OR - PREFIX - PHRASE - PRECEDENCE - ESCAPE - WHITESPACE - FUZZY - NEAR - SLOP - ALL _types.query_dsl.WeightedTokensQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: tokens: description: The tokens representing this query oneOf: - type: object additionalProperties: type: number - type: array items: type: object additionalProperties: type: number pruning_config: description: Token pruning configurations allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - tokens security._types.RoleTemplateInlineQuery: oneOf: - type: string - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' _types.Routing: description: Only to be used in query and path parameters, as the array form is actually a csv oneOf: - type: string - type: array items: type: string _types.aggregations.BucketsPath: description: 'Buckets path can be expressed in different ways, and an aggregation may accept some or all of these forms depending on its type. Please refer to each aggregation''s documentation to know what buckets path forms they accept.' oneOf: - type: string - type: array items: type: string - type: object additionalProperties: type: string _types.aggregations.MinBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.analysis.RussianAnalyzer: type: object properties: type: type: string enum: - russian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type indices._types.MappingLimitSettingsNestedObjects: type: object properties: limit: description: 'The maximum number of nested JSON objects that a single document can contain across all nested types. This limit helps to prevent out of memory errors when a document contains too many nested objects.' default: 10000.0 type: number _types.aggregations.GeoCentroidAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: count: type: number location: allOf: - $ref: '#/components/schemas/_types.GeoLocation' _types.query_dsl.IntervalsRange: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string gte: description: Lower term, either gte or gt must be provided. type: string gt: description: Lower term, either gte or gt must be provided. type: string lte: description: Upper term, either lte or lt must be provided. type: string lt: description: Upper term, either lte or lt must be provided. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' _types.analysis.PathHierarchyTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - path_hierarchy buffer_size: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' delimiter: type: string replacement: type: string reverse: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' skip: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' required: - type _global.search._types.ScriptRescore: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.analysis.ChineseAnalyzer: type: object properties: type: type: string enum: - chinese stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string required: - type _types.query_dsl.RankFeatureFunctionLogarithm: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: scaling_factor: description: Configurable scaling factor. type: number required: - scaling_factor _types.query_dsl.GeoDistanceQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: distance: description: 'The radius of the circle centred on the specified location. Points which fall into this circle are considered to be matches.' allOf: - $ref: '#/components/schemas/_types.Distance' distance_type: description: 'How to compute the distance. Set to `plane` for a faster calculation that''s inaccurate on long distances and close to the poles.' default: '''arc''' allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' validation_method: description: 'Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude. Set to `COERCE` to also try to infer correct latitude or longitude.' default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean required: - distance _types.analysis.SerbianAnalyzer: type: object properties: type: type: string enum: - serbian stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type _types.query_dsl.GeoDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBaseGeoLocationDistance' - type: object _types.aggregations.BucketCorrelationFunction: type: object properties: count_correlation: description: The configuration to calculate a count correlation. This function is designed for determining the correlation of a term value and a given metric. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunctionCountCorrelation' required: - count_correlation _types.analysis.PorterStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - porter_stem required: - type _types.analysis.IcuTransformTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_transform dir: allOf: - $ref: '#/components/schemas/_types.analysis.IcuTransformDirection' id: type: string required: - type - id _types.analysis.PhoneticTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - phonetic encoder: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticEncoder' languageset: oneOf: - $ref: '#/components/schemas/_types.analysis.PhoneticLanguage' - type: array items: $ref: '#/components/schemas/_types.analysis.PhoneticLanguage' max_code_len: type: number name_type: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticNameType' replace: type: boolean rule_type: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticRuleType' required: - type - encoder _types.aggregations.BucketsLongTermsBucket: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.LongTermsBucket' - type: array items: $ref: '#/components/schemas/_types.aggregations.LongTermsBucket' _types.IBLambda: type: string enum: - df - ttf _types.query_dsl.IntervalsMatch: type: object properties: analyzer: description: Analyzer used to analyze terms in the query. type: string max_gaps: description: 'Maximum number of positions between the matching terms. Terms further apart than this are not considered matches.' default: -1.0 type: number ordered: description: If `true`, matching terms must appear in their specified order. default: false type: boolean query: description: Text you wish to find in the provided field. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `term` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' filter: description: An optional interval filter. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - query _types.aggregations.PercentilesBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: percents: description: The list of percentiles to calculate. type: array items: type: number _types.ChunkRescorer: type: object properties: size: description: The number of chunks per document to evaluate for reranking. type: number chunking_settings: description: Chunking settings to apply allOf: - $ref: '#/components/schemas/_types.mapping.ChunkRescorerChunkingSettings' _types.analysis.SoraniAnalyzer: type: object properties: type: type: string enum: - sorani stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: type: string stem_exclusion: type: array items: type: string required: - type inference._types.EmbeddingContentType: type: string enum: - text - image - audio - video - pdf _types.aggregations.IpRangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are used to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' ranges: description: Array of IP ranges. type: array items: $ref: '#/components/schemas/_types.aggregations.IpRangeAggregationRange' _types.analysis.KStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kstem required: - type _types.aggregations.AggregateOrder: oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.SortOrder' minProperties: 1 maxProperties: 1 - type: array items: type: object additionalProperties: $ref: '#/components/schemas/_types.SortOrder' minProperties: 1 maxProperties: 1 security.get_user_profile.GetUserProfileErrors: type: object properties: count: type: number details: type: object additionalProperties: $ref: '#/components/schemas/_types.ErrorCause' required: - count - details _types.aggregations.MinAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.aggregations.CompositeAggregationSource: type: object properties: terms: description: A terms aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeTermsAggregation' histogram: description: A histogram aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeHistogramAggregation' date_histogram: description: A date histogram aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeDateHistogramAggregation' geotile_grid: description: A geotile grid aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeGeoTileGridAggregation' minProperties: 1 maxProperties: 1 _types.ErrorCause: description: 'Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.' type: object properties: type: description: The type of error type: string reason: description: A human-readable explanation of the error, in English. oneOf: - type: string - type: - string - 'null' stack_trace: description: The server stack trace. Present only if the `error_trace=true` parameter was sent with the request. type: string caused_by: allOf: - $ref: '#/components/schemas/_types.ErrorCause' root_cause: type: array items: $ref: '#/components/schemas/_types.ErrorCause' suppressed: type: array items: $ref: '#/components/schemas/_types.ErrorCause' required: - type _types.aggregations.HoltLinearModelSettings: type: object properties: alpha: type: number beta: type: number indices._types.MappingLimitSettingsNestedFields: type: object properties: limit: description: 'The maximum number of distinct nested mappings in an index. The nested type should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique nested types per index.' default: 50.0 type: number _types.aggregations.MultiBucketAggregateBaseFiltersBucket: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsFiltersBucket' required: - buckets _types.UnitMillis: description: Time unit for milliseconds type: number _types.aggregations.MultiBucketAggregateBaseVoid: allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateBase' - type: object properties: buckets: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsVoid' required: - buckets security.query_api_keys.ApiKeyAggregate: oneOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityAggregate' - $ref: '#/components/schemas/_types.aggregations.ValueCountAggregate' - $ref: '#/components/schemas/_types.aggregations.StringTermsAggregate' - $ref: '#/components/schemas/_types.aggregations.LongTermsAggregate' - $ref: '#/components/schemas/_types.aggregations.DoubleTermsAggregate' - $ref: '#/components/schemas/_types.aggregations.UnmappedTermsAggregate' - $ref: '#/components/schemas/_types.aggregations.MultiTermsAggregate' - $ref: '#/components/schemas/_types.aggregations.MissingAggregate' - $ref: '#/components/schemas/_types.aggregations.FilterAggregate' - $ref: '#/components/schemas/_types.aggregations.FiltersAggregate' - $ref: '#/components/schemas/_types.aggregations.RangeAggregate' - $ref: '#/components/schemas/_types.aggregations.DateRangeAggregate' - $ref: '#/components/schemas/_types.aggregations.CompositeAggregate' Kibana_HTTP_APIs_security_role_response: additionalProperties: false description: A Kibana role definition returned by the Roles API. properties: _transform_error: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_transform_error' type: array _unrecognized_applications: items: description: Application names found on the role that are not recognized by Kibana. type: string type: array description: description: A description for the role. type: string elasticsearch: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_elasticsearch' kibana: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_privilege_response' type: array metadata: additionalProperties: {} type: object name: description: The role name. type: string transient_metadata: additionalProperties: {} type: object required: - name - elasticsearch - kibana title: security_role_response type: object Kibana_HTTP_APIs_security_role_kibana_application: additionalProperties: false description: A raw Elasticsearch application privilege entry tied to Kibana. properties: application: type: string privileges: items: type: string type: array resources: items: type: string type: array required: - application - privileges - resources title: security_role_kibana_application type: object Kibana_HTTP_APIs_security_query_roles_response: additionalProperties: false description: The response payload for a roles query. properties: count: description: The number of roles returned in this response page. type: number roles: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response' type: array total: description: The total number of roles that match the query. type: number required: - roles - count - total title: security_query_roles_response type: object Kibana_HTTP_APIs_security_role_remote_indices_privileges: additionalProperties: false description: The remote indices privileges entry. properties: allow_restricted_indices: description: Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too. type: boolean clusters: items: description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions. type: string maxItems: 100 minItems: 1 type: array field_security: additionalProperties: items: description: The document fields that the role members have read access to. type: string maxItems: 1000 type: array type: object names: items: description: A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*). type: string maxItems: 100 minItems: 1 type: array privileges: items: description: The index level privileges that role members have for the specified indices. type: string maxItems: 100 minItems: 1 type: array query: description: 'A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. ' type: string required: - clusters - names - privileges title: security_role_remote_indices_privileges type: object Kibana_HTTP_APIs_security_role_elasticsearch: additionalProperties: false description: The Elasticsearch cluster, index, and remote cluster security privileges for the role. properties: cluster: items: description: Cluster privileges that define the cluster level actions that users can perform. type: string maxItems: 100 type: array indices: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_indices_privileges' maxItems: 1000 type: array remote_cluster: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_remote_cluster_privileges' maxItems: 100 type: array remote_indices: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_remote_indices_privileges' maxItems: 1000 type: array run_as: items: description: A username that members of this role can impersonate. type: string maxItems: 100 type: array title: security_role_elasticsearch type: object Kibana_HTTP_APIs_security_role_transform_error: additionalProperties: false description: Diagnostic information about a role whose Kibana privileges could not be transformed. properties: reason: description: The reason the role could not be fully transformed. type: string state: items: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_application' type: array required: - reason title: security_role_transform_error type: object Kibana_HTTP_APIs_security_query_roles_filters: additionalProperties: false description: The filter criteria for the query. properties: showReservedRoles: type: boolean title: security_query_roles_filters type: object Kibana_HTTP_APIs_security_role_kibana_privilege_response: additionalProperties: false description: A Kibana privilege entry returned for a role. properties: _reserved: items: description: A reserved Kibana privilege granted globally. type: string type: array base: items: description: A base Kibana privilege. type: string type: array feature: additionalProperties: items: description: A privilege the role member has for the feature. type: string type: array type: object spaces: items: description: A space that the privilege applies to. The wildcard `*` indicates all spaces. type: string type: array required: - spaces - base - feature title: security_role_kibana_privilege_response type: object Kibana_HTTP_APIs_security_query_roles_sort: additionalProperties: false description: The sort criteria for the query. properties: direction: enum: - asc - desc type: string field: type: string required: - field - direction title: security_query_roles_sort type: object Kibana_HTTP_APIs_security_role_remote_cluster_privileges: additionalProperties: false description: The remote cluster privileges entry. properties: clusters: items: description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions. type: string maxItems: 100 minItems: 1 type: array privileges: items: description: The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges. type: string maxItems: 100 minItems: 1 type: array required: - privileges - clusters title: security_role_remote_cluster_privileges type: object Kibana_HTTP_APIs_security_role_indices_privileges: additionalProperties: false description: The indices privileges entry. properties: allow_restricted_indices: description: Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too. type: boolean field_security: additionalProperties: items: description: The document fields that the role members have read access to. type: string maxItems: 1000 type: array type: object names: items: description: The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*). type: string maxItems: 100 minItems: 1 type: array privileges: items: description: The index level privileges that the role members have for the data streams and indices. type: string maxItems: 100 minItems: 1 type: array query: description: A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. type: string required: - names - privileges title: security_role_indices_privileges type: object Kibana_HTTP_APIs_security_query_roles_body: additionalProperties: false description: The request body for querying roles. properties: filters: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_filters' from: type: number query: type: string size: type: number sort: $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_sort' title: security_query_roles_body type: object parameters: security.get_user-username: in: path name: username description: An identifier for the user. You can specify multiple usernames as a comma-separated list. If you omit this parameter, the API retrieves information about all users. required: true deprecated: false schema: oneOf: - $ref: '#/components/schemas/_types.Username' - type: array items: $ref: '#/components/schemas/_types.Username' style: simple security.enable_user-username: in: path name: username description: An identifier for the user. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: simple security.put_role_mapping-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.get_privileges-name: in: path name: name description: 'The name of the privilege. If you do not specify this parameter, the API returns information about all privileges for the requested application.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple security.disable_user-username: in: path name: username description: An identifier for the user. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: simple security.put_role-name: in: path name: name description: The name of the role that is being created or updated. On Elasticsearch Serverless, the role name must begin with a letter or digit and can only contain letters, digits and the characters '_', '-', and '.'. Each role must have a unique name, as this will serve as the identifier for that role. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple security.update_user_profile_data-if_primary_term: in: query name: if_primary_term description: Only perform the operation if the document has this primary term. deprecated: false schema: type: number style: form security.update_user_profile_data-refresh: in: query name: refresh description: 'If ''true'', Elasticsearch refreshes the affected shards to make this operation visible to search. If ''wait_for'', it waits for a refresh to make this operation visible to search. If ''false'', nothing is done with refreshes.' deprecated: false schema: default: 'false' allOf: - $ref: '#/components/schemas/_types.Refresh' style: form security.create_service_token-name: in: path name: name description: 'The name for the service account token. If omitted, a random name will be generated. Token names must be at least one and no more than 256 characters. They can contain alphanumeric characters (a-z, A-Z, 0-9), dashes (`-`), and underscores (`_`), but cannot begin with an underscore. NOTE: Token names must be unique in the context of the associated service account. They must also be globally unique with their fully qualified names, which are comprised of the service account principal and token name, such as `//`.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple security.suggest_user_profiles-data: in: query name: data description: 'A comma-separated list of filters for the `data` field of the profile document. To return all content use `data=*`. To return a subset of content, use `data=` to retrieve content nested under the specified ``. By default, the API returns no `data` content. It is an error to specify `data` as both the query parameter and the request body field.' deprecated: false schema: oneOf: - type: string - type: array items: type: string style: form security.create_service_token-service: in: path name: service description: The name of the service. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Service' style: simple security.change_password-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.query_user-with_profile_uid: in: query name: with_profile_uid description: Determines whether to retrieve the user profile UID, if it exists, for the users. deprecated: false schema: default: false type: boolean style: form security.create_api_key-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.create_service_token-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.query_api_keys-with_profile_uid: in: query name: with_profile_uid description: 'Determines whether to also retrieve the profile UID for the API key owner principal. If it exists, the profile UID is returned under the `profile_uid` response field for each API key.' deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.14.0 style: form security.query_api_keys-typed_keys: in: query name: typed_keys description: Determines whether aggregation names are prefixed by their respective types in the response. deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.14.0 style: form security.disable_user_profile-refresh: in: query name: refresh description: 'If ''true'', Elasticsearch refreshes the affected shards to make this operation visible to search. If ''wait_for'', it waits for a refresh to make this operation visible to search. If ''false'', it does nothing with refreshes.' deprecated: false schema: default: 'false' allOf: - $ref: '#/components/schemas/_types.Refresh' style: form security.enable_user_profile-uid: in: path name: uid description: A unique identifier for the user profile. required: true deprecated: false schema: $ref: '#/components/schemas/security._types.UserProfileId' style: simple security.create_service_token-namespace: in: path name: namespace description: The name of the namespace, which is a top-level grouping of service accounts. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Namespace' style: simple security.get_service_accounts-service: in: path name: service description: 'The service name. Omit this parameter to retrieve information about all service accounts that belong to the specified `namespace`.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Service' style: simple security.disable_user_profile-uid: in: path name: uid description: Unique identifier for the user profile. required: true deprecated: false schema: $ref: '#/components/schemas/security._types.UserProfileId' style: simple security.update_user_profile_data-if_seq_no: in: query name: if_seq_no description: Only perform the operation if the document has this sequence number. deprecated: false schema: $ref: '#/components/schemas/_types.SequenceNumber' style: form security.put_user-refresh: in: query name: refresh description: 'Valid values are `true`, `false`, and `wait_for`. These values have the same meaning as in the index API, but the default value for this API is true.' deprecated: false schema: default: 'true' allOf: - $ref: '#/components/schemas/_types.Refresh' style: form security.change_password-username: in: path name: username description: 'The user whose password you want to change. If you do not specify this parameter, the password is changed for the current user.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: simple security.update_user_profile_data-uid: in: path name: uid description: A unique identifier for the user profile. required: true deprecated: false schema: $ref: '#/components/schemas/security._types.UserProfileId' style: simple security.enable_user_profile-refresh: in: query name: refresh description: 'If ''true'', Elasticsearch refreshes the affected shards to make this operation visible to search. If ''wait_for'', it waits for a refresh to make this operation visible to search. If ''false'', nothing is done with refreshes.' deprecated: false schema: default: 'false' allOf: - $ref: '#/components/schemas/_types.Refresh' style: form security.put_privileges-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.put_role_mapping-name: in: path name: name description: 'The distinct name that identifies the role mapping. The name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple security.put_user-username: in: path name: username description: 'An identifier for the user. NOTE: Usernames must be at least 1 and no more than 507 characters. They can contain alphanumeric characters (a-z, A-Z, 0-9), spaces, punctuation, and printable symbols in the Basic Latin (ASCII) block. Leading or trailing whitespace is not allowed.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Username' style: simple security.get_privileges-application: in: path name: application description: 'The name of the application. Application privileges are always associated with exactly one application. If you do not specify this parameter, the API returns information about all privileges for all applications.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple security.enable_user-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.disable_user-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.put_role-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.get_role_mapping-name: in: path name: name description: The distinct name that identifies the role mapping. The name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way. You can specify multiple mapping names as a comma-separated list. If you do not specify this parameter, the API returns information about all role mappings. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple security.has_privileges-user: in: path name: user description: Username required: true deprecated: false schema: $ref: '#/components/schemas/_types.Name' style: simple security.get_role-name: in: path name: name description: 'The name of the role. You can specify multiple roles as a comma-separated list. If you do not specify this parameter, the API returns information about all roles.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Names' style: simple security.get_user-with_profile_uid: in: query name: with_profile_uid description: Determines whether to retrieve the user profile UID, if it exists, for the users. deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.5.0 style: form security.query_api_keys-with_limited_by: in: query name: with_limited_by description: 'Return the snapshot of the owner user''s role descriptors associated with the API key. An API key''s actual permission is the intersection of its assigned role descriptors and the owner user''s role descriptors (effectively limited by it). An API key cannot retrieve any API key’s limited-by role descriptors (including itself) unless it has `manage_api_key` or higher privileges.' deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 8.5.0 style: form security.clone_api_key-refresh: in: query name: refresh description: If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes. deprecated: false schema: $ref: '#/components/schemas/_types.Refresh' style: form security.get_role-include_implicit: in: query name: include_implicit description: 'If `true`, include privileges that are implicitly granted by registered `ImplicitPrivilegesProviders` alongside the explicitly configured privileges. Each implicit entry in the response is annotated with `implicitly_granted: true`.' deprecated: false schema: default: false type: boolean x-state: Generally available; Added in 9.5.0 style: form security.get_service_accounts-namespace: in: path name: namespace description: 'The name of the namespace. Omit this parameter to retrieve information about all service accounts. If you omit this parameter, you must also omit the `service` parameter.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Namespace' style: simple requestBodies: security.put_privileges: content: application/json: schema: type: object additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/security.put_privileges.Actions' examples: SecurityPutPrivilegesRequestExample1: summary: Add a privilege description: 'Run `PUT /_security/privilege` to add a single application privilege. The wildcard (`*`) means that this privilege grants access to all actions that start with `data:read/`. Elasticsearch does not assign any meaning to these actions. However, if the request includes an application privilege such as `data:read/users` or `data:read/settings`, the has privileges API respects the use of a wildcard and returns `true`. ' value: "{\n \"myapp\": {\n \"read\": {\n \"actions\": [ \n \"data:read/*\" , \n \"action:login\" ],\n \"metadata\": { \n \"description\": \"Read access to myapp\"\n }\n }\n }\n}" SecurityPutPrivilegesRequestExample2: summary: Add multiple privileges description: 'Run `PUT /_security/privilege` to add multiple application privileges. ' value: "{\n \"app01\": {\n \"read\": {\n \"actions\": [ \"action:login\", \"data:read/*\" ]\n },\n \"write\": {\n \"actions\": [ \"action:login\", \"data:write/*\" ]\n }\n },\n \"app02\": {\n \"all\": {\n \"actions\": [ \"*\" ]\n }\n }\n}" required: true security.query_user: content: application/json: schema: type: object properties: query: description: 'A query to filter which users to return. If the query parameter is missing, it is equivalent to a `match_all` query. The query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`, `ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`. You can query the following information associated with user: `username`, `roles`, `enabled`, `full_name`, and `email`.' allOf: - $ref: '#/components/schemas/security.query_user.UserQueryContainer' from: description: 'The starting document offset. It must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 0.0 type: number sort: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/sort-search-results description: 'The sort definition. Fields eligible for sorting are: `username`, `roles`, `enabled`. In addition, sort can also be applied to the `_doc` field to sort by index order.' allOf: - $ref: '#/components/schemas/_types.Sort' size: description: 'The number of hits to return. It must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 10.0 type: number search_after: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/paginate-search-results#search-after description: The search after definition allOf: - $ref: '#/components/schemas/_types.SortResults' examples: SecurityQueryUserRequestExample1: summary: Query users by role prefix description: 'Run `POST /_security/_query/user?with_profile_uid=true` to get users that have roles that are prefixed with `other`. It will also include the user `profile_uid` in the response. ' value: "{\n \"query\": {\n \"prefix\": {\n \"roles\": \"other\"\n }\n }\n}" SecurityQueryUserRequestExample2: summary: Query users with multiple conditions description: 'Run `POST /_security/_query/user`. Use a `bool` query to issue complex logical conditions: The `email` must end with `example.com`. The user must be enabled. The result will be filtered to only contain users with at least one role that contains the substring `other`. The offset to begin the search result is the second (zero-based index) user. The page size of the response is two users. The result is sorted by `username` in descending order. ' value: "{\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"wildcard\": {\n \"email\": \"*example.com\" \n }\n },\n {\n \"term\": {\n \"enabled\": true \n }\n }\n ],\n \"filter\": [\n {\n \"wildcard\": {\n \"roles\": \"*other*\" \n }\n }\n ]\n }\n },\n \"from\": 1, \n \"size\": 2, \n \"sort\": [\n { \"username\": { \"order\": \"desc\"} } \n ]\n}" security.query_api_keys: content: application/json: schema: type: object properties: aggregations: description: 'Any aggregations to run over the corpus of returned API keys. Aggregations and queries work together. Aggregations are computed only on the API keys that match the query. This supports only a subset of aggregation types, namely: `terms`, `range`, `date_range`, `missing`, `cardinality`, `value_count`, `composite`, `filter`, and `filters`. Additionally, aggregations only run over the same subset of fields that query works with.' type: object additionalProperties: $ref: '#/components/schemas/security.query_api_keys.ApiKeyAggregationContainer' query: description: 'A query to filter which API keys to return. If the query parameter is missing, it is equivalent to a `match_all` query. The query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`, `ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`. You can query the following public information associated with an API key: `id`, `type`, `name`, `creation`, `expiration`, `invalidated`, `invalidation`, `username`, `realm`, and `metadata`. NOTE: The queryable string values associated with API keys are internally mapped as keywords. Consequently, if no `analyzer` parameter is specified for a `match` query, then the provided match query string is interpreted as a single keyword value. Such a match query is hence equivalent to a `term` query.' allOf: - $ref: '#/components/schemas/security.query_api_keys.ApiKeyQueryContainer' from: description: 'The starting document offset. It must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 0.0 type: number sort: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/sort-search-results description: 'The sort definition. Other than `id`, all public fields of an API key are eligible for sorting. In addition, sort can also be applied to the `_doc` field to sort by index order.' allOf: - $ref: '#/components/schemas/_types.Sort' size: description: 'The number of hits to return. It must not be negative. The `size` parameter can be set to `0`, in which case no API key matches are returned, only the aggregation results. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 10.0 type: number search_after: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/paginate-search-results#search-after description: The search after definition. allOf: - $ref: '#/components/schemas/_types.SortResults' examples: QueryApiKeysRequestExample1: summary: Query API keys by ID description: Run `GET /_security/_query/api_key?with_limited_by=true` to retrieve an API key by ID. value: "{\n \"query\": {\n \"ids\": {\n \"values\": [\n \"VuaCfGcBCdbkQm-e5aOx\"\n ]\n }\n }\n}" QueryApiKeysRequestExample2: summary: Query API keys with pagination description: 'Run `GET /_security/_query/api_key`. Use a `bool` query to issue complex logical conditions and use `from`, `size`, and `sort` to help paginate the result. For example, the API key name must begin with `app1-key-` and must not be `app1-key-01`. It must be owned by a username with the wildcard pattern `org-*-user` and the `environment` metadata field must have a `production` value. The offset to begin the search result is the twentieth (zero-based index) API key. The page size of the response is 10 API keys. The result is first sorted by creation date in descending order, then by name in ascending order. ' value: "{\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"prefix\": {\n \"name\": \"app1-key-\" \n }\n },\n {\n \"term\": {\n \"invalidated\": \"false\" \n }\n }\n ],\n \"must_not\": [\n {\n \"term\": {\n \"name\": \"app1-key-01\" \n }\n }\n ],\n \"filter\": [\n {\n \"wildcard\": {\n \"username\": \"org-*-user\" \n }\n },\n {\n \"term\": {\n \"metadata.environment\": \"production\" \n }\n }\n ]\n }\n },\n \"from\": 20, \n \"size\": 10, \n \"sort\": [ \n { \"creation\": { \"order\": \"desc\", \"format\": \"date_time\" } },\n \"name\"\n ]\n}" QueryApiKeysRequestExample3: summary: Query API keys by name description: Run `GET /_security/_query/api_key` to retrieve the API key by name. value: "{\n \"query\": {\n \"term\": {\n \"name\": {\n \"value\": \"application-key-1\"\n }\n }\n }\n}" security.has_privileges_user_profile: content: application/json: schema: type: object properties: uids: description: A list of profile IDs. The privileges are checked for associated users of the profiles. type: array items: $ref: '#/components/schemas/security._types.UserProfileId' privileges: description: An object containing all the privileges to be checked. allOf: - $ref: '#/components/schemas/security.has_privileges_user_profile.PrivilegesCheck' required: - uids - privileges examples: HasPrivilegesUserProfileRequestExample1: description: 'Run `POST /_security/profile/_has_privileges` to check whether the two users associated with the specified profiles have all the requested set of cluster, index, and application privileges. ' value: "{\n \"uids\": [\n \"u_LQPnxDxEjIH0GOUoFkZr5Y57YUwSkL9Joiq-g4OCbPc_0\",\n \"u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1\",\n \"u_does-not-exist_0\"\n ],\n \"privileges\": {\n \"cluster\": [ \"monitor\", \"create_snapshot\", \"manage_ml\" ],\n \"index\" : [\n {\n \"names\": [ \"suppliers\", \"products\" ],\n \"privileges\": [ \"create_doc\"]\n },\n {\n \"names\": [ \"inventory\" ],\n \"privileges\" : [ \"read\", \"write\" ]\n }\n ],\n \"application\": [\n {\n \"application\": \"inventory_manager\",\n \"privileges\" : [ \"read\", \"data:write/inventory\" ],\n \"resources\" : [ \"product/1852563\" ]\n }\n ]\n }\n}" required: true security.query_role: content: application/json: schema: type: object properties: query: description: 'A query to filter which roles to return. If the query parameter is missing, it is equivalent to a `match_all` query. The query supports a subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`, `ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`. You can query the following information associated with roles: `name`, `description`, `metadata`, `applications.application`, `applications.privileges`, and `applications.resources`.' allOf: - $ref: '#/components/schemas/security.query_role.RoleQueryContainer' from: description: 'The starting document offset. It must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 0.0 type: number sort: description: 'The sort definition. You can sort on `name`, `description`, `metadata`, `applications.application`, `applications.privileges`, and `applications.resources`. In addition, sort can also be applied to the `_doc` field to sort by index order.' allOf: - $ref: '#/components/schemas/_types.Sort' size: description: 'The number of hits to return. It must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 10.0 type: number search_after: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/paginate-search-results#search-after description: The search after definition. allOf: - $ref: '#/components/schemas/_types.SortResults' examples: QueryRolesRequestExample1: summary: Query roles by name description: Run `POST /_security/_query/role` to lists all roles, sorted by the role name. value: "{\n \"sort\": [\"name\"]\n}" QueryRolesRequestExample2: summary: Query roles by description description: 'Run `POST /_security/_query/role` to query only the user access role, given its description. It returns only the best matching role because `size` is set to `1`. ' value: "{\n \"query\": {\n \"match\": {\n \"description\": {\n \"query\": \"user access\"\n }\n }\n },\n \"size\": 1 \n}" security.put_user: content: application/json: schema: type: object properties: username: allOf: - $ref: '#/components/schemas/_types.Username' email: description: The email of the user. oneOf: - type: string - type: - string - 'null' full_name: description: The full name of the user. oneOf: - type: string - type: - string - 'null' metadata: description: Arbitrary metadata that you want to associate with the user. allOf: - $ref: '#/components/schemas/_types.Metadata' password: description: 'The user''s password. Passwords must be at least 6 characters long. When adding a user, one of `password` or `password_hash` is required. When updating an existing user, the password is optional, so that other fields on the user (such as their roles) may be updated without modifying the user''s password' allOf: - $ref: '#/components/schemas/_types.Password' password_hash: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/security-settings#hashing-settings description: 'A hash of the user''s password. This must be produced using the same hashing algorithm as has been configured for password storage. For more details, see the explanation of the `xpack.security.authc.password_hashing.algorithm` setting in the user cache and password hash algorithm documentation. Using this parameter allows the client to pre-hash the password for performance and/or confidentiality reasons. The `password` parameter and the `password_hash` parameter cannot be used in the same request.' type: string roles: description: 'A set of roles the user has. The roles determine the user''s access permissions. To create a user without any roles, specify an empty list (`[]`).' type: array items: type: string enabled: description: Specifies whether the user is enabled. default: true type: boolean examples: SecurityPutUserRequestExample1: description: Run `POST /_security/user/jacknich` to activate a user profile. value: "{\n \"password\" : \"l0ng-r4nd0m-p@ssw0rd\",\n \"roles\" : [ \"admin\", \"other_role1\" ],\n \"full_name\" : \"Jack Nicholson\",\n \"email\" : \"jacknich@example.com\",\n \"metadata\" : {\n \"intelligence\" : 7\n }\n}" required: true security.clone_api_key: content: application/json: schema: type: object properties: api_key: description: 'The credentials of the API key to clone. This is the secret value returned when the key was originally created.' type: string name: description: 'A name for the cloned API key. If not provided, the name of the source key is used.' allOf: - $ref: '#/components/schemas/_types.Name' expiration: description: 'The expiration time for the cloned API key. By default, API keys never expire. Set to `null` to explicitly create a key with no expiration.' allOf: - $ref: '#/components/schemas/_types.Duration' metadata: description: 'Arbitrary metadata to associate with the cloned API key. It supports nested data structure. Within the metadata object, keys beginning with `_` are reserved for system usage.' allOf: - $ref: '#/components/schemas/_types.Metadata' required: - api_key required: true security.update_user_profile_data: content: application/json: schema: type: object properties: labels: description: 'Searchable data that you want to associate with the user profile. This field supports a nested data structure. Within the labels object, top-level keys cannot begin with an underscore (`_`) or contain a period (`.`).' type: object additionalProperties: type: object data: description: 'Non-searchable data that you want to associate with the user profile. This field supports a nested data structure. Within the `data` object, top-level keys cannot begin with an underscore (`_`) or contain a period (`.`). The data object is not searchable, but can be retrieved with the get user profile API.' type: object additionalProperties: type: object examples: UpdateUserProfileDataRequestExample1: description: 'Run `POST /_security/profile/u_P_0BMHgaOK3p7k-PFWUCbw9dQ-UFjt01oWJ_Dp2PmPc_0/_data` to update a profile document for the `u_P_0BMHgaOK3p7k-PFWUCbw9dQ-UFjt01oWJ_Dp2PmPc_0` user profile. ' value: "{\n \"labels\": {\n \"direction\": \"east\"\n },\n \"data\": {\n \"app1\": {\n \"theme\": \"default\"\n }\n }\n}" required: true security.change_password: content: application/json: schema: type: object properties: password: description: The new password value. Passwords must be at least 6 characters long. allOf: - $ref: '#/components/schemas/_types.Password' password_hash: description: 'A hash of the new password value. This must be produced using the same hashing algorithm as has been configured for password storage. For more details, see the explanation of the `xpack.security.authc.password_hashing.algorithm` setting.' type: string examples: SecurityChangePasswordRequestExample1: description: 'Run `POST /_security/user/jacknich/_password` to update the password for the `jacknich` user. ' value: "{\n \"password\" : \"new-test-password\"\n}" required: true security.put_role: content: application/json: schema: type: object properties: applications: description: A list of application privilege entries. type: array items: $ref: '#/components/schemas/security._types.ApplicationPrivileges' cluster: description: A list of cluster privileges. These privileges define the cluster-level actions for users with this role. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' global: description: An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges. type: object additionalProperties: type: object indices: description: A list of indices permissions entries. type: array items: $ref: '#/components/schemas/security._types.IndicesPrivileges' remote_indices: description: 'A list of remote indices permissions entries. NOTE: Remote indices are effective for remote clusters configured with the API key based model. They have no effect for remote clusters configured with the certificate based model.' x-state: Generally available; Added in 8.14.0 type: array items: $ref: '#/components/schemas/security._types.RemoteIndicesPrivileges' remote_cluster: description: A list of remote cluster permissions entries. x-state: Generally available; Added in 8.15.0 type: array items: $ref: '#/components/schemas/security._types.RemoteClusterPrivileges' metadata: description: Optional metadata. Within the metadata object, keys that begin with an underscore (`_`) are reserved for system use. allOf: - $ref: '#/components/schemas/_types.Metadata' run_as: externalDocs: url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/submitting-requests-on-behalf-of-other-users description: 'A list of users that the owners of this role can impersonate. *Note*: in Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty `run_as` field, but a non-empty list will be rejected.' type: array items: type: string description: description: Optional description of the role descriptor type: string transient_metadata: description: Indicates roles that might be incompatible with the current cluster license, specifically roles with document and field level security. When the cluster license doesn’t allow certain features for a given role, this parameter is updated dynamically to list the incompatible features. If `enabled` is `false`, the role is ignored, but is still listed in the response from the authenticate API. type: object additionalProperties: type: object examples: SecurityPutRoleRequestExample1: summary: Role example 1 description: Run `POST /_security/role/my_admin_role` to create a role. value: "{\n \"description\": \"Grants full access to all management features within the cluster.\",\n \"cluster\": [\"all\"],\n \"indices\": [\n {\n \"names\": [ \"index1\", \"index2\" ],\n \"privileges\": [\"all\"],\n \"field_security\" : { // optional\n \"grant\" : [ \"title\", \"body\" ]\n },\n \"query\": \"{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}\" // optional\n }\n ],\n \"applications\": [\n {\n \"application\": \"myapp\",\n \"privileges\": [ \"admin\", \"read\" ],\n \"resources\": [ \"*\" ]\n }\n ],\n \"run_as\": [ \"other_user\" ], // optional\n \"metadata\" : { // optional\n \"version\" : 1\n }\n}" SecurityPutRoleRequestExample2: summary: Role example 2 description: Run `POST /_security/role/cli_or_drivers_minimal` to configure a role that can run SQL in JDBC. value: "{\n \"cluster\": [\"cluster:monitor/main\"],\n \"indices\": [\n {\n \"names\": [\"test\"],\n \"privileges\": [\"read\", \"indices:admin/get\"]\n }\n ]\n}" SecurityPutRoleRequestExample3: summary: Role example 3 description: Run `POST /_security/role/only_remote_access_role` to configure a role with remote indices and remote cluster privileges for a remote cluster. value: "{\n \"remote_indices\": [\n {\n \"clusters\": [\"my_remote\"], \n \"names\": [\"logs*\"], \n \"privileges\": [\"read\", \"read_cross_cluster\", \"view_index_metadata\"] \n }\n ],\n \"remote_cluster\": [\n {\n \"clusters\": [\"my_remote\"], \n \"privileges\": [\"monitor_stats\"] \n }\n ]\n}" required: true security.suggest_user_profiles: content: application/json: schema: type: object properties: name: description: 'A query string used to match name-related fields in user profile documents. Name-related fields are the user''s `username`, `full_name`, and `email`.' type: string size: description: The number of profiles to return. default: 10.0 type: number data: description: 'A comma-separated list of filters for the `data` field of the profile document. To return all content use `data=*`. To return a subset of content, use `data=` to retrieve content nested under the specified ``. By default, the API returns no `data` content. It is an error to specify `data` as both the query parameter and the request body field.' oneOf: - type: string - type: array items: type: string hint: description: 'Extra search criteria to improve relevance of the suggestion result. Profiles matching the spcified hint are ranked higher in the response. Profiles not matching the hint aren''t excluded from the response as long as the profile matches the `name` field query.' allOf: - $ref: '#/components/schemas/security.suggest_user_profiles.Hint' examples: SuggestUserProfilesRequestExample1: description: 'Run `POST /_security/profile/_suggest` to get suggestions for profile documents with name-related fields matching `jack`. It specifies both `uids` and `labels` hints for better relevance. The `labels` hint ranks profiles higher if their `direction` label matches either `north` or `east`. ' value: "{\n \"name\": \"jack\", \n \"hint\": {\n \"uids\": [ \n \"u_8RKO7AKfEbSiIHZkZZ2LJy2MUSDPWDr3tMI_CkIGApU_0\",\n \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\"\n ],\n \"labels\": {\n \"direction\": [\"north\", \"east\"] \n }\n }\n}" security.create_api_key: content: application/json: schema: type: object properties: expiration: description: 'The expiration time for the API key. By default, API keys never expire.' allOf: - $ref: '#/components/schemas/_types.Duration' name: description: A name for the API key. allOf: - $ref: '#/components/schemas/_types.Name' role_descriptors: externalDocs: url: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-put-role description: 'An array of role descriptors for this API key. When it is not specified or it is an empty array, the API key will have a point in time snapshot of permissions of the authenticated user. If you supply role descriptors, the resultant permissions are an intersection of API keys permissions and the authenticated user''s permissions thereby limiting the access scope for API keys. The structure of role descriptor is the same as the request for the create role API. For more details, refer to the create or update roles API. NOTE: Due to the way in which this permission intersection is calculated, it is not possible to create an API key that is a child of another API key, unless the derived key is created without any privileges. In this case, you must explicitly specify a role descriptor with no privileges. The derived API key can be used for authentication; it will not have authority to call Elasticsearch APIs.' type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleDescriptor' metadata: description: Arbitrary metadata that you want to associate with the API key. It supports nested data structure. Within the metadata object, keys beginning with `_` are reserved for system usage. x-state: Generally available; Added in 7.13.0 allOf: - $ref: '#/components/schemas/_types.Metadata' examples: SecurityCreateApiKeyRequestExample1: description: 'Run `POST /_security/api_key` to create an API key. If `expiration` is not provided, the API keys do not expire. If `role_descriptors` is not provided, the permissions of the authenticated user are applied. ' value: "{\n \"name\": \"my-api-key\",\n \"expiration\": \"1d\", \n \"role_descriptors\": { \n \"role-a\": {\n \"cluster\": [\"all\"],\n \"indices\": [\n {\n \"names\": [\"index-a*\"],\n \"privileges\": [\"read\"]\n }\n ]\n },\n \"role-b\": {\n \"cluster\": [\"all\"],\n \"indices\": [\n {\n \"names\": [\"index-b*\"],\n \"privileges\": [\"all\"]\n }\n ]\n }\n },\n \"metadata\": {\n \"application\": \"my-application\",\n \"environment\": {\n \"level\": 1,\n \"trusted\": true,\n \"tags\": [\"dev\", \"staging\"]\n }\n }\n}" required: true security.has_privileges: content: application/json: schema: type: object properties: application: type: array items: $ref: '#/components/schemas/security.has_privileges.ApplicationPrivilegesCheck' cluster: description: A list of the cluster privileges that you want to check. type: array items: $ref: '#/components/schemas/security._types.ClusterPrivilege' index: type: array items: $ref: '#/components/schemas/security.has_privileges.IndexPrivilegesCheck' examples: SecurityHasPrivilegesRequestExample1: description: Run `GET /_security/user/_has_privileges` to check whether the current user has a specific set of cluster, index, and application privileges. value: "{\n \"cluster\": [ \"monitor\", \"manage\" ],\n \"index\" : [\n {\n \"names\": [ \"suppliers\", \"products\" ],\n \"privileges\": [ \"read\" ]\n },\n {\n \"names\": [ \"inventory\" ],\n \"privileges\" : [ \"read\", \"write\" ]\n }\n ],\n \"application\": [\n {\n \"application\": \"inventory_manager\",\n \"privileges\" : [ \"read\", \"data:write/inventory\" ],\n \"resources\" : [ \"product/1852563\" ]\n }\n ]\n}" required: true security.put_role_mapping: content: application/json: schema: type: object properties: enabled: description: Mappings that have `enabled` set to `false` are ignored when role mapping is performed. type: boolean metadata: description: 'Additional metadata that helps define which roles are assigned to each user. Within the metadata object, keys beginning with `_` are reserved for system usage.' allOf: - $ref: '#/components/schemas/_types.Metadata' roles: description: 'A list of role names that are granted to the users that match the role mapping rules. Exactly one of `roles` or `role_templates` must be specified.' type: array items: type: string role_templates: description: 'A list of Mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules. Exactly one of `roles` or `role_templates` must be specified.' type: array items: $ref: '#/components/schemas/security._types.RoleTemplate' rules: description: 'The rules that determine which users should be matched by the mapping. A rule is a logical condition that is expressed by using a JSON DSL.' allOf: - $ref: '#/components/schemas/security._types.RoleMappingRule' run_as: type: array items: type: string examples: SecurityPutRoleMappingRequestExample1: summary: Roles for all users description: 'Run `POST /_security/role_mapping/mapping1` to assign the `user` role to all users. ' value: "{\n \"roles\": [ \"user\"],\n \"enabled\": true, \n \"rules\": {\n \"field\" : { \"username\" : \"*\" }\n },\n \"metadata\" : { \n \"version\" : 1\n }\n}" SecurityPutRoleMappingRequestExample2: summary: Roles for specific users description: 'Run `POST /_security/role_mapping/mapping2` to assign the "user" and "admin" roles to specific users. ' value: "{\n \"roles\": [ \"user\", \"admin\" ],\n \"enabled\": true,\n \"rules\": {\n \"field\" : { \"username\" : [ \"esadmin01\", \"esadmin02\" ] }\n }\n}" SecurityPutRoleMappingRequestExample3: summary: Roles for specific realms description: 'Run `POST /_security/role_mapping/mapping3` to match users who authenticated against a specific realm. ' value: "{\n \"roles\": [ \"ldap-user\" ],\n \"enabled\": true,\n \"rules\": {\n \"field\" : { \"realm.name\" : \"ldap1\" }\n }\n}" SecurityPutRoleMappingRequestExample4: summary: Roles for specific groups description: 'Run `POST /_security/role_mapping/mapping4` to match any user where either the username is `esadmin` or the user is in the `cn=admin,dc=example,dc=com group`. This example is useful when the group names in your identity management system (such as Active Directory, or a SAML Identity Provider) do not have a one-to-one correspondence with the names of roles in Elasticsearch. The role mapping is the means by which you link a group name with a role name. ' value: "{\n \"roles\": [ \"superuser\" ],\n \"enabled\": true,\n \"rules\": {\n \"any\": [\n {\n \"field\": {\n \"username\": \"esadmin\"\n }\n },\n {\n \"field\": {\n \"groups\": \"cn=admins,dc=example,dc=com\"\n }\n }\n ]\n }\n}" SecurityPutRoleMappingRequestExample5: summary: Roles for multiple groups description: 'Run `POST /_security/role_mapping/mapping5` to use an array syntax for the groups field when there are multiple groups. This pattern matches any of the groups (rather than all of the groups). ' value: "{\n \"role_templates\": [\n {\n \"template\": { \"source\": \"{{#tojson}}groups{{/tojson}}\" }, \n \"format\" : \"json\" \n }\n ],\n \"rules\": {\n \"field\" : { \"realm.name\" : \"saml1\" }\n },\n \"enabled\": true\n}" SecurityPutRoleMappingRequestExample6: summary: Templated roles for groups description: 'Run `POST /_security/role_mapping/mapping6` for rare cases when the names of your groups may be an exact match for the names of your Elasticsearch roles. This can be the case when your SAML Identity Provider includes its own "group mapping" feature and can be configured to release Elasticsearch role names in the user''s SAML attributes. In these cases it is possible to use a template that treats the group names as role names. NOTE: This should only be done if you intend to define roles for all of the provided groups. Mapping a user to a large number of unnecessary or undefined roles is inefficient and can have a negative effect on system performance. If you only need to map a subset of the groups, you should do it by using explicit mappings. The `tojson` mustache function is used to convert the list of group names into a valid JSON array. Because the template produces a JSON array, the `format` must be set to `json`. ' value: "{\n \"role_templates\": [\n {\n \"template\": { \"source\": \"{{#tojson}}groups{{/tojson}}\" }, \n \"format\" : \"json\" \n }\n ],\n \"rules\": {\n \"field\" : { \"realm.name\" : \"saml1\" }\n },\n \"enabled\": true\n}" SecurityPutRoleMappingRequestExample7: summary: Users in a LDAP sub-tree and realm description: 'Run `POST /_security/role_mapping/mapping7` to match users within a particular LDAP sub-tree in a specific realm. ' value: "{\n \"roles\": [ \"ldap-example-user\" ],\n \"enabled\": true,\n \"rules\": {\n \"all\": [\n { \"field\" : { \"dn\" : \"*,ou=subtree,dc=example,dc=com\" } },\n { \"field\" : { \"realm.name\" : \"ldap1\" } }\n ]\n }\n}" SecurityPutRoleMappingRequestExample8: summary: Complex roles description: 'Run `POST /_security/role_mapping/mapping8` to assign rules that are complex and include wildcard matching. For example, this mapping matches any user where all of these conditions are met: the Distinguished Name matches the pattern `*,ou=admin,dc=example,dc=com`, or the `username` is `es-admin`, or the `username` is `es-system`; the user is in the `cn=people,dc=example,dc=com` group; the user does not have a `terminated_date`. ' value: "{\n \"roles\": [ \"superuser\" ],\n \"enabled\": true,\n \"rules\": {\n \"all\": [\n {\n \"any\": [\n {\n \"field\": {\n \"dn\": \"*,ou=admin,dc=example,dc=com\"\n }\n },\n {\n \"field\": {\n \"username\": [ \"es-admin\", \"es-system\" ]\n }\n }\n ]\n },\n {\n \"field\": {\n \"groups\": \"cn=people,dc=example,dc=com\"\n }\n },\n {\n \"except\": {\n \"field\": {\n \"metadata.terminated_date\": null\n }\n }\n }\n ]\n }\n}" SecurityPutRoleMappingRequestExample9: summary: Templated roles description: 'Run `POST /_security/role_mapping/mapping9` to use templated roles to automatically map every user to their own custom role. In this example every user who authenticates using the `cloud-saml` realm will be automatically mapped to two roles: the `saml_user` role and a role that is their username prefixed with `_user_`. For example, the user `nwong` would be assigned the `saml_user` and `_user_nwong` roles. ' value: "{\n \"rules\": { \"field\": { \"realm.name\": \"cloud-saml\" } },\n \"role_templates\": [\n { \"template\": { \"source\" : \"saml_user\" } }, \n { \"template\": { \"source\" : \"_user_{{username}}\" } }\n ],\n \"enabled\": true\n}" required: true responses: security.create_api_key-200: description: '' content: application/json: schema: type: object properties: api_key: description: Generated API key. type: string expiration: description: Expiration in milliseconds for the API key. type: number id: description: Unique ID for this API key. allOf: - $ref: '#/components/schemas/_types.Id' name: description: Specifies the name for this API key. allOf: - $ref: '#/components/schemas/_types.Name' encoded: description: 'API key credentials which is the base64-encoding of the UTF-8 representation of `id` and `api_key` joined by a colon (`:`).' x-state: Generally available; Added in 7.16.0 type: string required: - api_key - id - name - encoded examples: SecurityCreateApiKeyResponseExample1: description: A successful response from `POST /_security/api_key`. value: "{\n \"id\": \"VuaCfGcBCdbkQm-e5aOx\", \n \"name\": \"my-api-key\",\n \"expiration\": 1544068612110, \n \"api_key\": \"ui2lp2axTNmsyakw9tvNnw\", \n \"encoded\": \"VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==\" \n}" security.disable_user_profile-200: description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' security.query_api_keys-200: description: '' content: application/json: schema: type: object properties: total: description: The total number of API keys found. type: number count: description: The number of API keys returned in the response. type: number api_keys: description: A list of API key information. type: array items: $ref: '#/components/schemas/security._types.ApiKey' aggregations: description: The aggregations result, if requested. type: object additionalProperties: $ref: '#/components/schemas/security.query_api_keys.ApiKeyAggregate' required: - total - count - api_keys examples: QueryApiKeysResponseExample1: summary: Query API keys by ID description: 'A successful response from `GET /_security/_query/api_key?with_limited_by=true`. The `limited_by` details are the owner user''s permissions associated with the API key. It is a point-in-time snapshot captured at creation and subsequent updates. An API key''s effective permissions are an intersection of its assigned privileges and the owner user''s permissions. ' value: "{\n \"api_keys\": [\n {\n \"id\": \"VuaCfGcBCdbkQm-e5aOx\",\n \"name\": \"application-key-1\",\n \"creation\": 1548550550158,\n \"expiration\": 1548551550158,\n \"invalidated\": false,\n \"username\": \"myuser\",\n \"realm\": \"native1\",\n \"realm_type\": \"native\",\n \"metadata\": {\n \"application\": \"my-application\"\n },\n \"role_descriptors\": { },\n \"limited_by\": [ \n {\n \"role-power-user\": {\n \"cluster\": [\n \"monitor\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"*\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"allow_restricted_indices\": false\n }\n ],\n \"applications\": [ ],\n \"run_as\": [ ],\n \"metadata\": { },\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n }\n ]\n }\n ]\n}" QueryApiKeysResponseExample2: summary: Query API keys with pagination description: 'An abbreviated response from `GET /_security/_query/api_key` that contains a list of matched API keys along with their sort values. The first sort value is creation time, which is displayed in `date_time` format. The second sort value is the API key name. ' value: "{\n \"total\": 100,\n \"count\": 10,\n \"api_keys\": [\n {\n \"id\": \"CLXgVnsBOGkf8IyjcXU7\",\n \"name\": \"app1-key-79\",\n \"creation\": 1629250154811,\n \"invalidated\": false,\n \"username\": \"org-admin-user\",\n \"realm\": \"native1\",\n \"metadata\": {\n \"environment\": \"production\"\n },\n \"role_descriptors\": { },\n \"_sort\": [\n \"2021-08-18T01:29:14.811Z\", \n \"app1-key-79\" \n ]\n },\n {\n \"id\": \"BrXgVnsBOGkf8IyjbXVB\",\n \"name\": \"app1-key-78\",\n \"creation\": 1629250153794,\n \"invalidated\": false,\n \"username\": \"org-admin-user\",\n \"realm\": \"native1\",\n \"metadata\": {\n \"environment\": \"production\"\n },\n \"role_descriptors\": { },\n \"_sort\": [\n \"2021-08-18T01:29:13.794Z\",\n \"app1-key-78\"\n ]\n }\n ]\n}" QueryApiKeysResponseExample3: summary: Query all API keys description: 'A successful response from `GET /_security/_query/api_key`. It includes the role descriptors that are assigned to each API key when it was created or last updated. Note that an API key''s effective permissions are an intersection of its assigned privileges and the point-in-time snapshot of the owner user''s permissions. An empty role descriptors object means the API key inherits the owner user''s permissions. ' value: "{\n \"total\": 3,\n \"count\": 3,\n \"api_keys\": [ \n {\n \"id\": \"nkvrGXsB8w290t56q3Rg\",\n \"name\": \"my-api-key-1\",\n \"creation\": 1628227480421,\n \"expiration\": 1629091480421,\n \"invalidated\": false,\n \"username\": \"elastic\",\n \"realm\": \"reserved\",\n \"realm_type\": \"reserved\",\n \"metadata\": {\n \"letter\": \"a\"\n },\n \"role_descriptors\": { \n \"role-a\": {\n \"cluster\": [\n \"monitor\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"index-a\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"allow_restricted_indices\": false\n }\n ],\n \"applications\": [ ],\n \"run_as\": [ ],\n \"metadata\": { },\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n }\n },\n {\n \"id\": \"oEvrGXsB8w290t5683TI\",\n \"name\": \"my-api-key-2\",\n \"creation\": 1628227498953,\n \"expiration\": 1628313898953,\n \"invalidated\": false,\n \"username\": \"elastic\",\n \"realm\": \"reserved\",\n \"metadata\": {\n \"letter\": \"b\"\n },\n \"role_descriptors\": { } \n }\n ]\n}" security.has_privileges_user_profile-200: description: '' content: application/json: schema: type: object properties: has_privilege_uids: description: 'The subset of the requested profile IDs of the users that have all the requested privileges.' type: array items: $ref: '#/components/schemas/security._types.UserProfileId' errors: description: 'The subset of the requested profile IDs for which an error was encountered. It does not include the missing profile IDs or the profile IDs of the users that do not have all the requested privileges. This field is absent if empty.' allOf: - $ref: '#/components/schemas/security.has_privileges_user_profile.HasPrivilegesUserProfileErrors' required: - has_privilege_uids examples: HasPrivilegesUserProfileResponseExample1: description: 'A response from `POST /_security/profile/_has_privileges` that indicates only one of the three users has all the privileges and one of them is not found. ' value: "{\n \"has_privilege_uids\": [\"u_rzRnxDgEHIH0GOUoFkZr5Y27YUwSk19Joiq=g4OCxxB_1\"],\n \"errors\": {\n \"count\": 1,\n \"details\": {\n \"u_does-not-exist_0\": {\n \"type\": \"resource_not_found_exception\",\n \"reason\": \"profile document not found\"\n }\n }\n }\n}" security.put_privileges-200: description: '' content: application/json: schema: type: object additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/security._types.CreatedStatus' examples: SecurityPutPrivilegesResponseExample1: description: A successful response from `PUT /_security/privilege`. value: "{\n \"myapp\": {\n \"read\": {\n \"created\": true \n }\n }\n}" SecurityPutPrivilegesResponseExample2: description: 'A successful response from `PUT /_security/privilege`. The `created` property indicates whether the privileges have been created or updated. ' value: "{\n \"app02\": {\n \"all\": {\n \"created\": true\n }\n },\n \"app01\": {\n \"read\": {\n \"created\": true\n },\n \"write\": {\n \"created\": true\n }\n }\n}" security.query_user-200: description: '' content: application/json: schema: type: object properties: total: description: The total number of users found. type: number count: description: The number of users returned in the response. type: number users: description: A list of users that match the query. type: array items: $ref: '#/components/schemas/security.query_user.QueryUser' required: - total - count - users examples: SecurityQueryUserResponseExample1: summary: Query users by role prefix description: 'A successful response from `POST /_security/_query/user?with_profile_uid=true` that contains users that have roles that are prefixed with `other`. It also includes the user `profile_uid` in the response. ' value: "{\n \"total\": 1,\n \"count\": 1,\n \"users\": [\n {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\",\n \"other_role1\"\n ],\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\",\n \"metadata\": {\n \"intelligence\": 7\n },\n \"enabled\": true,\n \"profile_uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\"\n }\n ]\n}" SecurityQueryUserResponseExample2: summary: Query users with multiple conditions description: 'A successful response from `POST /_security/_query/user` that uses a `bool` query to issue complex logical conditions and uses `from`, `size`, and `sort` to help paginate the result. The sort value is `username`. ' value: "{\n \"total\": 5,\n \"count\": 2,\n \"users\": [\n {\n \"username\": \"ray\",\n \"roles\": [\n \"other_role3\"\n ],\n \"full_name\": \"Ray Nicholson\",\n \"email\": \"rayn@example.com\",\n \"metadata\": {\n \"intelligence\": 7\n },\n \"enabled\": true,\n \"_sort\": [\n \"ray\" \n ]\n },\n {\n \"username\": \"lorraine\",\n \"roles\": [\n \"other_role3\"\n ],\n \"full_name\": \"Lorraine Nicholson\",\n \"email\": \"lorraine@example.com\",\n \"metadata\": {\n \"intelligence\": 7\n },\n \"enabled\": true,\n \"_sort\": [\n \"lorraine\"\n ]\n }\n ]\n}" SecurityQueryUserResponseExample3: summary: Query all users description: 'A successful response from `GET /_security/_query/user`, which lists all users. It returns a JSON structure that contains the information retrieved from one or more users. ' value: "{\n \"total\": 2,\n \"count\": 2,\n \"users\": [ \n {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\",\n \"other_role1\"\n ],\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\",\n \"metadata\": {\n \"intelligence\": 7\n },\n \"enabled\": true\n },\n {\n \"username\": \"sandrakn\",\n \"roles\": [\n \"admin\",\n \"other_role1\"\n ],\n \"full_name\": \"Sandra Knight\",\n \"email\": \"sandrakn@example.com\",\n \"metadata\": {\n \"intelligence\": 7\n },\n \"enabled\": true\n }\n ]\n}" security.disable_user-200: description: '' content: application/json: schema: type: object security.get_service_accounts-200: description: '' content: application/json: schema: type: object additionalProperties: $ref: '#/components/schemas/security.get_service_accounts.RoleDescriptorWrapper' examples: GetServiceAccountsResponseExample1: description: 'A successful response from `GET /_security/service/elastic/fleet-server`. The response contains information about the `elastic/fleet-server` service account. ' value: "{\n \"elastic/fleet-server\": {\n \"role_descriptor\": {\n \"cluster\": [\n \"monitor\",\n \"manage_own_api_key\",\n \"read_fleet_secrets\"\n ],\n \"indices\": [\n {\n \"names\": [\n \"logs-*\",\n \"metrics-*\",\n \"traces-*\",\n \".logs-endpoint.diagnostic.collection-*\",\n \".logs-endpoint.action.responses-*\",\n \".logs-endpoint.heartbeat-*\"\n ],\n \"privileges\": [\n \"write\",\n \"create_index\",\n \"auto_configure\"\n ],\n \"allow_restricted_indices\": false\n },\n {\n \"names\": [\n \"profiling-*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\"\n ],\n \"allow_restricted_indices\": false\n },\n {\n \"names\": [\n \"traces-apm.sampled-*\"\n ],\n \"privileges\": [\n \"read\",\n \"monitor\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": false\n },\n {\n \"names\": [\n \".fleet-secrets*\"\n ],\n \"privileges\": [\n \"read\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-actions*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-agents*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-artifacts*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-enrollment-api-keys*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-policies*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-policies-leader*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-servers*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \".fleet-fileds*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"monitor\",\n \"create_index\",\n \"auto_configure\",\n \"maintenance\"\n ],\n \"allow_restricted_indices\": true\n },\n {\n \"names\": [\n \"synthetics-*\"\n ],\n \"privileges\": [\n \"read\",\n \"write\",\n \"create_index\",\n \"auto_configure\"\n ],\n \"allow_restricted_indices\": false\n }\n ],\n \"applications\": [\n {\n \"application\": \"kibana-*\",\n \"privileges\": [\n \"reserved_fleet-setup\"\n ],\n \"resources\": [\n \"*\"\n ]\n }\n ],\n \"run_as\": [],\n \"metadata\": {},\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n }\n}" security.create_service_token-200: description: '' content: application/json: schema: type: object properties: created: type: boolean token: allOf: - $ref: '#/components/schemas/security.create_service_token.Token' required: - created - token examples: CreateServiceTokenRequestExample1: description: 'A successful response from `POST /_security/service/elastic/fleet-server/credential/token/token1`. The response includes the service account token, its name, and its secret value as a bearer token. ' value: "{\n \"created\": true,\n \"token\": {\n \"name\": \"token1\",\n \"value\": \"AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ\" \n }\n}" security.get_user-200: description: '' content: application/json: schema: type: object additionalProperties: $ref: '#/components/schemas/security._types.User' examples: SecurityGetUserResponseExample1: description: 'A successful response from `GET /_security/user/jacknich?with_profile_uid=true`. It includes the user `profile_uid` as part of the response. ' value: "{\n \"jacknich\": {\n \"username\": \"jacknich\",\n \"roles\": [\n \"admin\", \"other_role1\"\n ],\n \"full_name\": \"Jack Nicholson\",\n \"email\": \"jacknich@example.com\",\n \"metadata\": { \"intelligence\" : 7 },\n \"enabled\": true,\n \"profile_uid\": \"u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0\"\n }\n}" security.put_role_mapping-200: description: '' content: application/json: schema: type: object properties: created: type: boolean role_mapping: allOf: - $ref: '#/components/schemas/security._types.CreatedStatus' required: - role_mapping examples: SecurityPutRoleMappingResponseExample1: description: A successful response from `POST /_security/role_mapping/mapping1`. value: "{\n \"role_mapping\" : {\n \"created\" : true \n }\n}" security.enable_user-200: description: '' content: application/json: schema: type: object security.get_role_mapping-200: description: '' content: application/json: schema: type: object additionalProperties: $ref: '#/components/schemas/security._types.RoleMapping' examples: SecurityGetRoleMappingResponseExample1: description: A successful response from `GET /_security/role_mapping/mapping1`. value: "{\n \"mapping1\": {\n \"enabled\": true,\n \"roles\": [\n \"user\"\n ],\n \"rules\": {\n \"field\": {\n \"username\": \"*\"\n }\n },\n \"metadata\": {}\n }\n}" security.put_role-200: description: '' content: application/json: schema: type: object properties: role: description: When an existing role is updated, `created` is set to `false`. allOf: - $ref: '#/components/schemas/security._types.CreatedStatus' required: - role examples: SecurityPutRoleResponseExample1: description: A successful response from `POST /_security/role/my_admin_role`. value: "{\n \"role\": {\n \"created\": true \n }\n}" security.clone_api_key-200: description: '' content: application/json: schema: type: object properties: api_key: description: The generated API key value for the cloned key. type: string expiration: description: Expiration in milliseconds for the API key. type: number id: description: The unique ID of the cloned API key. allOf: - $ref: '#/components/schemas/_types.Id' name: description: The name of the cloned API key. allOf: - $ref: '#/components/schemas/_types.Name' encoded: description: 'API key credentials which is the base64-encoding of the UTF-8 representation of `id` and `api_key` joined by a colon (`:`).' type: string required: - api_key - id - name - encoded security.change_password-200: description: '' content: application/json: schema: type: object security.suggest_user_profiles-200: description: '' content: application/json: schema: type: object properties: total: description: Metadata about the number of matching profiles. allOf: - $ref: '#/components/schemas/security.suggest_user_profiles.TotalUserProfiles' took: description: The number of milliseconds it took Elasticsearch to run the request. type: number profiles: description: A list of profile documents, ordered by relevance, that match the search criteria. type: array items: $ref: '#/components/schemas/security._types.UserProfile' required: - total - took - profiles examples: SuggestUserProfilesResponseExample1: description: 'A successful response from `GET /_security/saml/metadata/saml1`. It contains the SAML metadata that was generated for the SAML realm as an XML string. ' value: "{\n \"metadata\" : \"\"\n}" security.put_user-200: description: '' content: application/json: schema: type: object properties: created: description: 'A successful call returns a JSON structure that shows whether the user has been created or updated. When an existing user is updated, `created` is set to `false`.' type: boolean required: - created examples: SecurityPutUserResponseExample1: description: 'A successful response from `POST /_security/user/jacknich`. When an existing user is updated, `created` is set to `false`. ' value: "{\n \"created\": true \n}" security.query_role-200: description: '' content: application/json: schema: type: object properties: total: description: The total number of roles found. type: number count: description: The number of roles returned in the response. type: number roles: description: 'A list of roles that match the query. The returned role format is an extension of the role definition format. It adds the `transient_metadata.enabled` and the `_sort` fields. `transient_metadata.enabled` is set to `false` in case the role is automatically disabled, for example when the role grants privileges that are not allowed by the installed license. `_sort` is present when the search query sorts on some field. It contains the array of values that have been used for sorting.' type: array items: $ref: '#/components/schemas/security.query_role.QueryRole' required: - total - count - roles examples: QueryRolesResponseExample1: summary: Query roles by name description: 'A successful response from `POST /_security/_query/role`. It returns a JSON structure that contains the information retrieved for one or more roles. ' value: "{\n \"total\": 2,\n \"count\": 2,\n \"roles\": [ \n {\n \"name\" : \"my_admin_role\",\n \"cluster\" : [\n \"all\"\n ],\n \"indices\" : [\n {\n \"names\" : [\n \"index1\",\n \"index2\"\n ],\n \"privileges\" : [\n \"all\"\n ],\n \"field_security\" : {\n \"grant\" : [\n \"title\",\n \"body\"\n ]\n },\n \"allow_restricted_indices\" : false\n }\n ],\n \"applications\" : [ ],\n \"run_as\" : [\n \"other_user\"\n ],\n \"metadata\" : {\n \"version\" : 1\n },\n \"transient_metadata\" : {\n \"enabled\" : true\n },\n \"description\" : \"Grants full access to all management features within the cluster.\",\n \"_sort\" : [\n \"my_admin_role\"\n ]\n },\n {\n \"name\" : \"my_user_role\",\n \"cluster\" : [ ],\n \"indices\" : [\n {\n \"names\" : [\n \"index1\",\n \"index2\"\n ],\n \"privileges\" : [\n \"all\"\n ],\n \"field_security\" : {\n \"grant\" : [\n \"title\",\n \"body\"\n ]\n },\n \"allow_restricted_indices\" : false\n }\n ],\n \"applications\" : [ ],\n \"run_as\" : [ ],\n \"metadata\" : {\n \"version\" : 1\n },\n \"transient_metadata\" : {\n \"enabled\" : true\n },\n \"description\" : \"Grants user access to some indicies.\",\n \"_sort\" : [\n \"my_user_role\"\n ]\n }\n ]\n}" QueryRolesResponseExample2: summary: Query roles by description description: 'A successful response from `POST /_security/_query/role`. ' value: "{\n \"total\": 2,\n \"count\": 1,\n \"roles\": [\n {\n \"name\" : \"my_user_role\",\n \"cluster\" : [ ],\n \"indices\" : [\n {\n \"names\" : [\n \"index1\",\n \"index2\"\n ],\n \"privileges\" : [\n \"all\"\n ],\n \"field_security\" : {\n \"grant\" : [\n \"title\",\n \"body\"\n ]\n },\n \"allow_restricted_indices\" : false\n }\n ],\n \"applications\" : [ ],\n \"run_as\" : [ ],\n \"metadata\" : {\n \"version\" : 1\n },\n \"transient_metadata\" : {\n \"enabled\" : true\n },\n \"description\" : \"Grants user access to some indicies.\"\n }\n ]\n}" security.enable_user_profile-200: description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' security.has_privileges-200: description: '' content: application/json: schema: type: object properties: application: allOf: - $ref: '#/components/schemas/security.has_privileges.ApplicationsPrivileges' cluster: type: object additionalProperties: type: boolean has_all_requested: type: boolean index: type: object additionalProperties: $ref: '#/components/schemas/security.has_privileges.Privileges' username: allOf: - $ref: '#/components/schemas/_types.Username' required: - application - cluster - has_all_requested - index - username examples: SecurityHasPrivilegesResponseExample1: description: A successful response from `GET /_security/user/_has_privileges`, which lists the privileges for the `rdeniro` user. value: "{\n \"username\": \"rdeniro\",\n \"has_all_requested\" : false,\n \"cluster\" : {\n \"monitor\" : true,\n \"manage\" : false\n },\n \"index\" : {\n \"suppliers\" : {\n \"read\" : true\n },\n \"products\" : {\n \"read\" : true\n },\n \"inventory\" : {\n \"read\" : true,\n \"write\" : false\n }\n },\n \"application\" : {\n \"inventory_manager\" : {\n \"product/1852563\" : {\n \"read\": false,\n \"data:write/inventory\": false\n }\n }\n }\n}" security.update_user_profile_data-200: description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: UpdateUserProfileDataResponseExample1: description: 'A successful response from `POST /_security/profile/u_P_0BMHgaOK3p7k-PFWUCbw9dQ-UFjt01oWJ_Dp2PmPc_0/_data`, which indicates that the request is acknowledged. ' value: "{\n \"acknowledged\": true\n}" security.get_role-200: description: '' content: application/json: schema: type: object additionalProperties: $ref: '#/components/schemas/security.get_role.Role' examples: SecurityGetRoleResponseExample1: description: 'A successful response from `GET /_security/role/my_admin_role`. The response contains information about the `my_admin_role` role in the native realm. ' value: "{\n \"my_admin_role\": {\n \"description\": \"Grants full access to all management features within the cluster.\",\n \"cluster\" : [ \"all\" ],\n \"indices\" : [\n {\n \"names\" : [ \"index1\", \"index2\" ],\n \"privileges\" : [ \"all\" ],\n \"allow_restricted_indices\" : false,\n \"field_security\" : {\n \"grant\" : [ \"title\", \"body\" ]}\n }\n ],\n \"applications\" : [ ],\n \"run_as\" : [ \"other_user\" ],\n \"metadata\" : {\n \"version\" : 1\n },\n \"transient_metadata\": {\n \"enabled\": true\n }\n }\n}" security.get_privileges-200: description: '' content: application/json: schema: type: object additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/security.put_privileges.Actions' examples: SecurityGetPrivilegesResponseExample1: description: 'A successful response from `GET /_security/privilege/myapp/read`. The response contains information about the `read` privilege for the `app01` application. ' value: "{\n \"myapp\": {\n \"read\": {\n \"application\": \"myapp\",\n \"name\": \"read\",\n \"actions\": [\n \"data:read/*\",\n \"action:login\"\n ],\n \"metadata\": {\n \"description\": \"Read access to myapp\"\n }\n }\n }\n}" securitySchemes: apiKeyAuth: description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey` ' in: header name: Authorization type: apiKey basicAuth: scheme: basic type: http x-refined-from: - elk-stack-elasticsearch-openapi.json - elk-stack-kibana-openapi.yaml x-elastic: curl: auth: '-H "Authorization: ApiKey $ECE_API_KEY"'