You're viewing version 3.8 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
Patch Allow List API
Introduced 2.1
Updates an allow list configuration.
This API is reserved for a superadmin. Authenticate with an admin certificate rather than with a user name and password. For more information, see Access control for the API.
Endpoints
PATCH /_plugins/_security/api/allowlist
Request body fields
The request body is required. It is an array of JSON objects. Each object contains the following fields.
| Field | Data type | Description | Required |
|---|---|---|---|
op | String | The operation to perform. Valid values are add, remove, replace, move, copy, and test. | Yes |
path | String | The path to modify, such as /config/enabled or /config/requests. Because the path uses JSON Pointer syntax, escape any forward slash in a request path as ~1. For example, the path to the /_cat/shards entry is /config/requests/~1_cat~1shards. | Yes |
value | Object or array | The new value. Required for the add, replace, and test operations. | No |
Example request
The following request adds the /_cat/shards endpoint to the allow list:
PATCH _plugins/_security/api/allowlist
[
{
"op": "add",
"path": "/config/requests/~1_cat~1shards",
"value": [
"GET"
]
}
]
Example response
{
"status": "OK",
"message": "Resource updated."
}