Elasticsearch

Overview

Use Elasticsearch credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	elasticsearch
Category	Search
Credential Type	Encoded API Key

Step 1: Get Credentials

Log in to Elastic Cloud

Log in to Elastic Cloud and open the deployment.

Create an API key

In Kibana, go to Stack Management > Security > API keys and click Create API key.

Copy the encoded value

Copy the Encoded value — it is the base64 form used directly after ApiKey in the Authorization header, and is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Elasticsearch

Go to Managed Secrets > Add Provider > Elasticsearch.

Enter credentials

Paste your Encoded API Key into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-DEPLOYMENT.es.us-east-1.aws.elastic.cloud/my-index/_search",
    grant_id="YOUR_GRANT_ID",
    json={"query": {"match": {"title": "vector search"}}, "size": 5},
)

Notes

• The credential is injected as Authorization: ApiKey <encoded> — store the encoded form of the key.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
ml-post-data	send	POST	/_ml/anomaly_detectors/{job_id}/_data
async-search-delete	delete	DELETE	/_async_search/{id}
bulk-2	delete, write	POST	/{index}/_bulk
bulk-3	delete, write	PUT	/{index}/_bulk
cancel-reindex	delete, write	POST	/_reindex/{task_id}/_cancel
ccr-delete-auto-follow-pattern	delete	DELETE	/_ccr/auto_follow/{name}
cluster-delete-component-template	delete	DELETE	/_component_template/{name}
connector-delete	delete	DELETE	/_connector/{connector_id}
connector-sync-job-delete	delete	DELETE	/_connector/_sync_job/{connector_sync_job_id}
dangling-indices-delete-dangling-index	delete	DELETE	/_dangling/{index_uuid}
delete	delete	DELETE	/{index}/_doc/{id}
delete-by-query	delete, write	POST	/{index}/_delete_by_query
delete-by-query-rethrottle	delete, write	POST	/_delete_by_query/{task_id}/_rethrottle
delete-script	delete	DELETE	/_scripts/{id}
enrich-delete-policy	admin, delete	DELETE	/_enrich/policy/{name}
eql-delete	delete	DELETE	/_eql/search/{id}
esql-async-query-delete	delete	DELETE	/_query/async/{id}
esql-delete-view	delete	DELETE	/_query/view/{name}
ilm-delete-lifecycle	admin, delete	DELETE	/_ilm/policy/{policy}
indices-delete	delete	DELETE	/{index}
indices-delete-alias	delete	DELETE	/{index}/_alias/{name}
enrich-put-policy	admin, write	PUT	/_enrich/policy/{name}
ilm-put-lifecycle	admin, write	PUT	/_ilm/policy/{policy}
security-create-service-token	admin, write	PUT	/_security/service/{namespace}/{service}/credential/token/{name}
security-create-service-token-1	admin, write	POST	/_security/service/{namespace}/{service}/credential/token/{name}
security-create-service-token-2	admin, write	POST	/_security/service/{namespace}/{service}/credential/token
ccr-follow	write	PUT	/{index}/_ccr/follow
ccr-put-auto-follow-pattern	write	PUT	/_ccr/auto_follow/{name}
cluster-put-component-template	write	PUT	/_component_template/{name}
cluster-put-component-template-1	write	POST	/_component_template/{name}
connector-put	write	PUT	/_connector/{connector_id}
create	write	PUT	/{index}/_create/{id}
create-1	write	POST	/{index}/_create/{id}
esql-put-view	write	PUT	/_query/view/{name}
get-reindex	read	GET	/_reindex/{task_id}
inference-get-2	read	GET	/_inference/{task_type}/{inference_id}
inference-get-3	read	GET	/_inference/{task_type}/_all
ml-get-records	read	GET	/_ml/anomaly_detectors/{job_id}/results/records
security-get-user-profile	read	GET	/_security/profile/{uid}
security-saml-service-provider-metadata	read	GET	/_security/saml/metadata/{realm_name}