Patch Allow List API
Introduced 2.1
Updates an allow list configuration.
This API is reserved for a superadmin. Authenticate with an admin certificate rather than with a user name and password. For more information, see Access control for the API.
Endpoints
PATCH /_plugins/_security/api/allowlist
Request body fields
The request body is required. It is an array of JSON objects. Each object contains the following fields.
| Field | Data type | Description | Required |
|---|---|---|---|
op | String | The operation to perform. Valid values are add, remove, replace, move, copy, and test. | Yes |
path | String | The path to modify, such as /config/enabled or /config/requests. Because the path uses JSON Pointer syntax, escape any forward slash in a request path as ~1. For example, the path to the /_cat/shards entry is /config/requests/~1_cat~1shards. | Yes |
value | Object or array | The new value. Required for the add, replace, and test operations. | No |
Example request
The following request adds the /_cat/shards endpoint to the allow list:
PATCH _plugins/_security/api/allowlist
[
{
"op": "add",
"path": "/config/requests/~1_cat~1shards",
"value": [
"GET"
]
}
]
Example response
{
"status": "OK",
"message": "Resource updated."
}