# REST API for index restrictions **URL:** \ **Category:** Search Guard\ **Created:** [February 19, 2019, 5:54pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339 "2019-02-19T17:54:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Wyllys\_Ingersoll](https://avatars.discourse-cdn.com/v4/letter/w/ecb155/32.png) [@Wyllys\_Ingersoll](https://forum.search-guard.com/u/Wyllys_Ingersoll)\ **Post date:** [February 19, 2019, 5:54pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339/1 "2019-02-19T17:54:20Z")
Search Guard 6.5.3 Elasticsearch 6.5.3 JVM 1.8 Ubuntu Linux 18.04.1 Are there REST APIs for assigning access controls to individual elasticsearch indexes? For example, restricting access to a particular index to a specific SG user or SG group? Looking at the documents, it appears that I could use the REST api to create roles that restrict access to specific indexes and then assign those roles to a user - is that correct? thanks! ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [February 19, 2019, 6:11pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339/2 "2019-02-19T18:11:05Z")
Yes, the most common way is to: 1. Create Search Guard roles that implement the access restrictions you want > **[Search Guard roles](https://docs.search-guard.com/latest/roles-permissions)** > > How to define role based access to Elasticsearch on index level with Search Guard. > **[Roles API](https://docs.search-guard.com/latest/rest-api-roles)** > > How to use the roles REST API endpoints to manage roles and permissions. 1. Map users by their username or backend roles to the Search Guard roles defined in 1) > **[Mapping users to Search Guard roles](https://docs.search-guard.com/latest/mapping-users-roles)** > > How to map users and backend roles to Search Guard roles to implement flexible access control to an Elasticsearch cluster. > **[Roles mapping API](https://docs.search-guard.com/latest/rest-api-roles-mapping)** > > How to use the roles mapping REST API endpoints to assign users to Search Guard roles. As a side note, you can also skip the step of mapping users to SG roles, for example, if you want to use LDAP or AD group names directly: > **[Role mapping modes](https://docs.search-guard.com/latest/role-mapping-modes)** > > Different ways to use the Search Guard role mapping feature to map users, backend roles and hosts to Search Guard roles. But that is a special case and really only useful for the said LDAP/AD case. > **···** > > On Tuesday, February 19, 2019 at 6:54:20 PM UTC+1, Wyllys Ingersoll wrote: > > > > > > Search Guard 6.5.3 > > > Elasticsearch 6.5.3 > > > JVM 1.8 > > > Ubuntu Linux 18.04.1 > > > > > > Are there REST APIs for assigning access controls to individual elasticsearch indexes? For example, restricting access to a particular index to a specific SG user or SG group? > > > > > > Looking at the documents, it appears that I could use the REST api to create roles that restrict access to specific indexes and then assign those roles to a user - is that correct? > > > > > > thanks! ---
**Author:** ![furongzhou66](https://avatars.discourse-cdn.com/v4/letter/f/ecb155/32.png) [@furongzhou66](https://forum.search-guard.com/u/furongzhou66)\ **Post date:** [March 4, 2019, 11:30pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339/3 "2019-03-04T23:30:45Z")
The community version support the REST API ? 在 2019年2月20日星期三 UTC+8上午2:11:05，Jochen Kressin写道： > **···** > > > Yes, the most common way is to: > > > 1. Create Search Guard roles that implement the access restrictions you want > > > > > > [https://docs.search-guard.com/latest/roles-permissions](https://docs.search-guard.com/latest/roles-permissions) > > > [https://docs.search-guard.com/latest/rest-api-roles](https://docs.search-guard.com/latest/rest-api-roles) > > > > > > 1. Map users by their username or backend roles to the Search Guard roles defined in 1) > > > > > > [https://docs.search-guard.com/latest/mapping-users-roles](https://docs.search-guard.com/latest/mapping-users-roles) > > > [https://docs.search-guard.com/latest/rest-api-roles-mapping](https://docs.search-guard.com/latest/rest-api-roles-mapping) > > > > > > As a side note, you can also skip the step of mapping users to SG roles, for example, if you want to use LDAP or AD group names directly: > > > > > > [https://docs.search-guard.com/latest/role-mapping-modes](https://docs.search-guard.com/latest/role-mapping-modes) > > > > > > But that is a special case and really only useful for the said LDAP/AD case. > > > > On Tuesday, February 19, 2019 at 6:54:20 PM UTC+1, Wyllys Ingersoll wrote: > > > > > > > > > Search Guard 6.5.3 > > > > Elasticsearch 6.5.3 > > > > JVM 1.8 > > > > Ubuntu Linux 18.04.1 > > > > > > > > Are there REST APIs for assigning access controls to individual elasticsearch indexes? For example, restricting access to a particular index to a specific SG user or SG group? > > > > > > > > Looking at the documents, it appears that I could use the REST api to create roles that restrict access to specific indexes and then assign those roles to a user - is that correct? > > > > > > > > thanks! ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 4, 2019, 11:33pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339/4 "2019-03-04T23:33:32Z")
no, that is an enterprise feature Please see [Search Guard Security | Securing your Elasticsearch cluster with Search Guard](https://search-guard.com/product/) for a comparison matrix > **···** > > > Am 04.03.2019 um 15:30 schrieb furongzhou66@gmail.com: > > > > The community version support the REST API ? > > > > 在 2019年2月20日星期三 UTC+8上午2:11:05，Jochen Kressin写道： > > Yes, the most common way is to: > > > > 1. Create Search Guard roles that implement the access restrictions you want > > > > [Search Guard role-based authorization for Elasticsearch | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/roles-permissions) > > [Roles API | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/rest-api-roles) > > > > 2. Map users by their username or backend roles to the Search Guard roles defined in 1) > > > > [Mapping users to Search Guard roles | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/mapping-users-roles) > > [Roles mapping API | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/rest-api-roles-mapping) > > > > As a side note, you can also skip the step of mapping users to SG roles, for example, if you want to use LDAP or AD group names directly: > > > > [Role mapping modes | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/role-mapping-modes) > > > > But that is a special case and really only useful for the said LDAP/AD case. > > > > On Tuesday, February 19, 2019 at 6:54:20 PM UTC+1, Wyllys Ingersoll wrote: > > > > Search Guard 6.5.3 > > Elasticsearch 6.5.3 > > JVM 1.8 > > Ubuntu Linux 18.04.1 > > > > Are there REST APIs for assigning access controls to individual elasticsearch indexes? For example, restricting access to a particular index to a specific SG user or SG group? > > > > Looking at the documents, it appears that I could use the REST api to create roles that restrict access to specific indexes and then assign those roles to a user - is that correct? > > > > thanks! > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/94879316-2c3b-43c8-a3b4-9dda0337f0b2%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/94879316-2c3b-43c8-a3b4-9dda0337f0b2%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![furongzhou66](https://avatars.discourse-cdn.com/v4/letter/f/ecb155/32.png) [@furongzhou66](https://forum.search-guard.com/u/furongzhou66)\ **Post date:** [March 4, 2019, 11:43pm UTC](https://forum.search-guard.com/t/rest-api-for-index-restrictions/1339/5 "2019-03-04T23:43:20Z")
thanks a lot 在 2019年3月5日星期二 UTC+8上午7:33:44，Search Guard写道： > **···** > > > no, that is an enterprise feature > > > > Please see [https://search-guard.com/product/](https://search-guard.com/product/) for a comparison matrix > > > > > Am 04.03.2019 um 15:30 schrieb [furong...@gmail.com](mailto:furong...@gmail.com): > > > > > The community version support the REST API ? > > > > > 在 2019年2月20日星期三 UTC+8上午2:11:05，Jochen Kressin写道： > > > > > Yes, the most common way is to: > > > > > 1. Create Search Guard roles that implement the access restrictions you want > > > > > [https://docs.search-guard.com/latest/roles-permissions](https://docs.search-guard.com/latest/roles-permissions) > > > > > [https://docs.search-guard.com/latest/rest-api-roles](https://docs.search-guard.com/latest/rest-api-roles) > > > > > 1. Map users by their username or backend roles to the Search Guard roles defined in 1) > > > > > [https://docs.search-guard.com/latest/mapping-users-roles](https://docs.search-guard.com/latest/mapping-users-roles) > > > > > [https://docs.search-guard.com/latest/rest-api-roles-mapping](https://docs.search-guard.com/latest/rest-api-roles-mapping) > > > > > As a side note, you can also skip the step of mapping users to SG roles, for example, if you want to use LDAP or AD group names directly: > > > > > [https://docs.search-guard.com/latest/role-mapping-modes](https://docs.search-guard.com/latest/role-mapping-modes) > > > > > But that is a special case and really only useful for the said LDAP/AD case. > > > > > On Tuesday, February 19, 2019 at 6:54:20 PM UTC+1, Wyllys Ingersoll wrote: > > > > > Search Guard 6.5.3 > > > > > Elasticsearch 6.5.3 > > > > > JVM 1.8 > > > > > Ubuntu Linux 18.04.1 > > > > > Are there REST APIs for assigning access controls to individual elasticsearch indexes? For example, restricting access to a particular index to a specific SG user or SG group? > > > > > > Looking at the documents, it appears that I could use the REST api to create roles that restrict access to specific indexes and then assign those roles to a user - is that correct? > > > > > thanks! > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/94879316-2c3b-43c8-a3b4-9dda0337f0b2%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/94879316-2c3b-43c8-a3b4-9dda0337f0b2%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).