API key management in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this API key creation response?

You run this Elasticsearch API call to create an API key. What is the output?

Elasticsearch

POST /_security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "my-role": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["my-index"],
          "privileges": ["read"]
        }
      ]
    }
  }
}

A {"name":"my-api-key","api_key":"ZXhhbXBsZWFwaWtleQ=="}

B {"id":"abc123","name":"my-api-key"}

C {"error":"missing api_key field"}

D {"id":"abc123","name":"my-api-key","api_key":"ZXhhbXBsZWFwaWtleQ=="}

💡 Hint

The API key creation response includes the key ID, name, and the encoded key string.

When you create an API key in Elasticsearch, the response includes the unique ID, the name you gave it, and the base64 encoded API key string. This allows you to use the key for authentication.

❓ Predict Output

intermediate

What error does this API key deletion request produce?

You try to delete an API key with this request but get an error. What is the error?

Elasticsearch

DELETE /_security/api_key
{
  "id": "nonexistent-id"
}

A {"found":false}

B {"deleted":false}

C {"status":404,"error":"Not Found"}

D {"error":"api key not found"}

💡 Hint

Elasticsearch returns a simple found flag for deletion attempts.

When deleting an API key by ID, if the key does not exist, Elasticsearch returns {"found":false} indicating no key was deleted.

🧠 Conceptual

advanced

Which option correctly describes API key privileges in Elasticsearch?

Choose the correct statement about API key privileges in Elasticsearch.

A API keys can have both cluster and index privileges defined in role descriptors.

B API keys can only have cluster-wide privileges, not index privileges.

C API keys automatically inherit all privileges of the user who created them.

D API keys cannot be restricted and always have full access.

💡 Hint

Think about how roles define access in Elasticsearch.

API keys in Elasticsearch are created with role descriptors that specify both cluster and index privileges. This allows fine-grained access control.

❓ Predict Output

advanced

What is the output of this API key authentication attempt?

You use this API key in the Authorization header to authenticate. What is the expected response?

Elasticsearch

GET /_security/_authenticate
Headers: {"Authorization": "ApiKey ZXhhbXBsZWFwaWtleQ=="}

A {"error":"invalid api key"}

B {"username":"elastic","roles":["superuser"],"api_key":{"id":"abc123","name":"my-api-key"}}

C {"username":"elastic","roles":[],"api_key":null}

D {"status":401,"error":"Unauthorized"}

💡 Hint

Successful API key authentication returns user info and key details.

When authenticating with a valid API key, Elasticsearch returns the username, roles, and API key id and name used for authentication.

❓ Predict Output

expert

How many API keys are returned by this query?

You run this request to list API keys created by user 'alice'. How many keys are returned?

Elasticsearch

GET /_security/api_key?owner=true

A The response is empty because 'owner' is not a valid parameter.

B The response contains all API keys in the cluster regardless of owner, count is total keys.

C The response contains only API keys created by the authenticated user, count depends on keys owned.

D The response contains only API keys created by other users, excluding the authenticated user.

💡 Hint

The 'owner' parameter filters keys by the authenticated user.

Using "owner": true returns only API keys created by the user making the request, so the count depends on how many keys that user owns.