Manage API keys using service accounts

Elastic APIs enable programmatic access to StackOps Elastic features, and API keys are required to authenticate automated access securely. It is recommended to manage API keys using service accounts instead of personal user accounts, so that the API keys can be managed at deployment-level.

Generate API keys

Prerequisites:
- A service account

Generate an API key using Elastic’s Create an API key method. You should use your service account credentials (username and password) to get authenticated for this method.

To generate an API key:

1. Encode your service account username and password:

   echo -n "username:password" | base64Copy to clipboardErrorCopied

   This encoded credentials is the basic auth token used for generating an API key.

2. Construct a request to generate an API key. Make sure to set the encoded credentials from the previous step in the Authorization header.

   Example request:

   curl -X POST "<elastic_endpoint>/_security/api_key" \
   -H "Content-Type: application/json" \
   -H "Authorization: Basic <Base64 encoded credentials>" \
   -d '{
       "name": "my-new-api-key",
       "expiration": "1d",
       "role_descriptors": {
           "sosar_ingestor": {
               "cluster": ["monitor", "manage_own_api_key"],
               "indices": [
                   {
                       "names": ["logs-*", "metrics-*"],
                       "privileges": ["create_index", "create", "create_doc"]
                   }
               ],
               "applications": [],
               "run_as": [],
               "transient_metadata": {"enabled": true}
           }
       }
   }'Copy to clipboardErrorCopied

For more information, refer to Elastic API Documentation.

Retrieve API keys

Retrieve details about your API keys using Elastic’s Get API key. To retrieve API key information, you need one of these privileges:

• manage_own_api_key: Retrieve only the API keys you own.
• manage_api_key: Retrieve all API keys in the deployment.

Example request:

curl -X GET \
  -H "Authorization: ApiKey <elastic_api_key>" \
  "<elastic_endpoint>/_security/api_key?username=myuser&realm_name=native1"Copy to clipboardErrorCopied

For more information, refer to Elastic API Documentation.

Delete API keys

Delete an API key using Elastic’s Invalidate API keys method. Invalidated keys can no longer authenticate, but remain visible until automatically removed after the retention period. To delete API keys, you need one of these privileges:

• manage_own_api_key: Delete only your own API keys.
• manage_api_key: Delete any API key in the deployment.

If you are using the manage_own_api_key privilege, the request must include one of the following identifiers:

• owner=true
• both username and realm_name
• the key id (when invalidating itself)

Example request:

curl -X DELETE \
  -H "Authorization: ApiKey <elastic_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"ids":["VuaCfGcBCdbkQm-e5aOx"]}' \
  "<elastic_endpoint>/_security/api_key"Copy to clipboardErrorCopied

For more information, refer to Elastic API Documentation.