access: (可选，对象) 要授予此 API 密钥的访问权限。访问权限由跨集群搜索和跨集群复制的权限组成。必须至少指定其中一个。指定后，新的访问权限分配将完全替换先前分配的访问权限。有关字段结构，请参阅创建跨集群 API 密钥 API 的相同参数。
metadata: (可选，对象) 您要与 API 密钥关联的任意元数据。它支持嵌套数据结构。在metadata对象中，以_开头的顶级键保留供系统使用。指定后，这将完全替换先前与 API 密钥关联的元数据。
expiration: (可选，字符串) API 密钥的过期时间。默认情况下，API 密钥永不过期。可以省略以保持不变。

响应正文

编辑

updated: (布尔值) 如果为true，则 API 密钥已更新。如果为false，则 API 密钥未更改，因为未检测到任何更改。

示例

编辑

如果您按如下方式创建跨集群 API 密钥

resp = client.perform_request(
    "POST",
    "/_security/cross_cluster/api_key",
    headers={"Content-Type": "application/json"},
    body={
        "name": "my-cross-cluster-api-key",
        "access": {
            "search": [
                {
                    "names": [
                        "logs*"
                    ]
                }
            ]
        },
        "metadata": {
            "application": "search"
        }
    },
)
print(resp)

const response = await client.transport.request({
  method: "POST",
  path: "/_security/cross_cluster/api_key",
  body: {
    name: "my-cross-cluster-api-key",
    access: {
      search: [
        {
          names: ["logs*"],
        },
      ],
    },
    metadata: {
      application: "search",
    },
  },
});
console.log(response);

POST /_security/cross_cluster/api_key
{
  "name": "my-cross-cluster-api-key",
  "access": {
    "search": [
      {
        "names": ["logs*"]
      }
    ]
  },
  "metadata": {
    "application": "search"
  }
}

成功的调用将返回一个 JSON 结构，其中提供 API 密钥信息。例如

{
  "id": "VuaCfGcBCdbkQm-e5aOx",
  "name": "my-cross-cluster-api-key",
  "api_key": "ui2lp2axTNmsyakw9tvNnw",
  "encoded": "VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw=="
}

可以使用获取 API 密钥 API检查 API 密钥的信息，包括其精确的角色描述符。

resp = client.security.get_api_key(
    id="VuaCfGcBCdbkQm-e5aOx",
)
print(resp)

const response = await client.security.getApiKey({
  id: "VuaCfGcBCdbkQm-e5aOx",
});
console.log(response);

GET /_security/api_key?id=VuaCfGcBCdbkQm-e5aOx

成功的调用将返回一个包含 API 密钥信息的 JSON 结构。

{
  "api_keys": [
    {
      "id": "VuaCfGcBCdbkQm-e5aOx",
      "name": "my-cross-cluster-api-key",
      "type": "cross_cluster",
      "creation": 1548550550158,
      "expiration": null,
      "invalidated": false,
      "username": "myuser",
      "realm": "native1",
      "metadata": {
        "application": "search"
      },
      "role_descriptors": {
        "cross_cluster": {  
          "cluster": [
              "cross_cluster_search"
          ],
          "indices": [
            {
              "names": [
                "logs*"
              ],
              "privileges": [
                "read", "read_cross_cluster", "view_index_metadata"
              ],
              "allow_restricted_indices": false
            }
          ],
          "applications": [ ],
          "run_as": [ ],
          "metadata": { },
          "transient_metadata": {
            "enabled": true
          }
        }
      },
      "access": {  
        "search": [
          {
            "names": [
              "logs*"
            ],
            "allow_restricted_indices": false
          }
        ]
      }
    }
  ]
}

	对应于创建时指定的`access`范围的角色描述符。在此示例中，它为`logs*`索引模式授予跨集群搜索权限。
	`access`对应于 API 密钥创建时指定的值。

以下示例更新上面创建的 API 密钥，为其分配新的访问范围和元数据。

resp = client.perform_request(
    "PUT",
    "/_security/cross_cluster/api_key/VuaCfGcBCdbkQm-e5aOx",
    headers={"Content-Type": "application/json"},
    body={
        "access": {
            "replication": [
                {
                    "names": [
                        "archive"
                    ]
                }
            ]
        },
        "metadata": {
            "application": "replication"
        }
    },
)
print(resp)

const response = await client.transport.request({
  method: "PUT",
  path: "/_security/cross_cluster/api_key/VuaCfGcBCdbkQm-e5aOx",
  body: {
    access: {
      replication: [
        {
          names: ["archive"],
        },
      ],
    },
    metadata: {
      application: "replication",
    },
  },
});
console.log(response);

PUT /_security/cross_cluster/api_key/VuaCfGcBCdbkQm-e5aOx
{
  "access": {
    "replication": [
      {
        "names": ["archive"]
      }
    ]
  },
  "metadata": {
    "application": "replication"
  }
}

成功的调用将返回一个 JSON 结构，指示 API 密钥已更新。

{
  "updated": true
}

更新后 API 密钥的权限可以使用获取 API 密钥 API再次检查，结果将是

{
  "api_keys": [
    {
      "id": "VuaCfGcBCdbkQm-e5aOx",
      "name": "my-cross-cluster-api-key",
      "type": "cross_cluster",
      "creation": 1548550550158,
      "expiration": null,
      "invalidated": false,
      "username": "myuser",
      "realm": "native1",
      "metadata": {
        "application": "replication"
      },
      "role_descriptors": {
        "cross_cluster": {  
          "cluster": [
              "cross_cluster_replication"
          ],
          "indices": [
            {
              "names": [
                "archive*"
              ],
              "privileges": [
                "cross_cluster_replication", "cross_cluster_replication_internal"
              ],
              "allow_restricted_indices": false
            }
          ],
          "applications": [ ],
          "run_as": [ ],
          "metadata": { },
          "transient_metadata": {
            "enabled": true
          }
        }
      },
      "access": {  
        "replication": [
          {
            "names": [
              "archive*"
            ],
            "allow_restricted_indices": false
          }
        ]
      }
    }
  ]
}

	角色描述符将更新为更新时指定的`access`范围。在此示例中，它更新为为`archive*`索引模式授予跨集群复制权限。
	`access`对应于 API 密钥更新时指定的值。

« 创建跨集群 API 密钥 API 快照和恢复 API »