Skip to content

Commit 664fc2f

Browse files
[Docs] Update Query Roles API documentation (elastic#120740)
The query role API now returns built-in roles as well. This PR notes this and adds an example on how the built-in roles can be filtered out.
1 parent ff4f9d7 commit 664fc2f

File tree

2 files changed

+17
-3
lines changed

2 files changed

+17
-3
lines changed

docs/build.gradle

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,6 @@ testClusters.matching { it.name == "yamlRestTest"}.configureEach {
120120
// TODO: remove this once cname is prepended to transport.publish_address by default in 8.0
121121
systemProperty 'es.transport.cname_in_publish_address', 'true'
122122

123-
systemProperty 'es.queryable_built_in_roles_enabled', 'false'
124123

125124
requiresFeature 'es.index_mode_feature_flag_registered', Version.fromString("8.0.0")
126125
requiresFeature 'es.failure_store_feature_flag_enabled', Version.fromString("8.12.0")

docs/reference/rest-api/security/query-role.asciidoc

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,13 @@ Retrieves roles with <<query-dsl,Query DSL>> in a <<paginate-search-results,pagi
3131

3232
The role management APIs are generally the preferred way to manage roles, rather than using
3333
<<roles-management-file,file-based role management>>.
34-
The query roles API does not retrieve roles that are defined in roles files, nor <<built-in-roles,built-in>> ones.
34+
The query roles API does not retrieve roles that are defined in `roles.yml` files.
3535
You can optionally filter the results with a query. Also, the results can be paginated and sorted.
3636

37+
NOTE: This API automatically returns <<built-in-roles,built-in>> roles as well.
38+
The built-in roles can be filtered out by using the `metadata._reserved` field in the query.
39+
See <<security-api-query-role-example,example>> below.
40+
3741
[[security-api-query-role-request-body]]
3842
==== {api-request-body-title}
3943

@@ -127,12 +131,21 @@ It contains the array of values that have been used for sorting.
127131
[[security-api-query-role-example]]
128132
==== {api-examples-title}
129133

130-
The following request lists all roles, sorted by the role name:
134+
The following request lists all roles (except built-in ones), sorted by the role name:
131135

132136
[source,console]
133137
----
134138
POST /_security/_query/role
135139
{
140+
"query": {
141+
"bool": {
142+
"must_not": {
143+
"term": {
144+
"metadata._reserved": true
145+
}
146+
}
147+
}
148+
},
136149
"sort": ["name"]
137150
}
138151
----
@@ -222,6 +235,7 @@ retrieved for one or more roles:
222235
]
223236
}
224237
----
238+
// TESTRESPONSE[s/"total": 2/"total" : $body.total/]
225239
// TEST[continued]
226240

227241
<1> The list of roles that were retrieved for this request
@@ -287,3 +301,4 @@ POST /_security/_query/role
287301
]
288302
}
289303
----
304+
// TESTRESPONSE[s/"total": 2/"total" : $body.total/]

0 commit comments

Comments
 (0)