Allow list APIs
The allow list APIs control which APIs a user without administrator privileges can access.
OpenSearch supports the following allow list APIs.
| API | Description |
|---|---|
| Create or Update Allow List API | Creates or replaces the allow list configuration. |
| Patch Allow List API | Updates individual fields in the allow list configuration. |
| Get Allow List API | Retrieves the current allow list configuration. |
Required permissions
The allow list APIs are restricted to a super admin. Being mapped to a role listed in plugins.security.restapi.roles_enabled is not sufficient on its own: a user with the all_access role receives 403 Forbidden. To call these APIs, use one of the following approaches:
- Authenticate with an admin certificate. For more information, see Configuring an admin certificate.
- Grant a role the
restapi:admin/allowlistcluster permission and setplugins.security.restapi.admin.enabledtotrueinopensearch.yml. This permission is an independent grant, so the role does not also need to be listed inplugins.security.restapi.roles_enabled.
The reserved security_rest_api_full_access role includes restapi:admin/allowlist. A role that contains any restapi:admin permission cannot be created or modified through the Role APIs, so define your own such role in roles.yml and apply it with securityadmin.sh. For more information, see Applying changes to configuration files.
To prevent a role from using these APIs, disable the ALLOWLIST endpoint for that role using plugins.security.restapi.endpoints_disabled.