# Document level & Field level security with HighLevelRest client

**URL:** <https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 2, 2021, 6:00am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186 "2021-08-02T06:00:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PraveenKumar\_KG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveenkumar_kg/32/49776_2.png) [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\
**Post date:** [August 2, 2021, 6:00am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186/1 "2021-08-02T06:00:46Z")

</div>

Hi,

We have built an angular and SpringBoot based application to search the data in elasticsearch and render the search details in UI. Angular frontend has sign in with access restricted with RBAC. Now I want to restrict the query with doc level & field level access based on the roles details available springboot application by passing the roles details to high level rest client. Is this possible? My understanding from elasticsearch documentation is the field and doc level security is possible while directly calling the elasticsearch REST endpoint. But the Springboot application uses the technical user to connect to the cluster. Please advice how to achieve doc & field level security with high level rest client.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 2, 2021, 7:35am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186/2 "2021-08-02T07:35:43Z")

</div>

How about using `run-as`? See [Submitting requests on behalf of other users | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/run-as-privilege.html)

---

<div class="post-metadata">

**Author:** ![PraveenKumar\_KG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveenkumar_kg/32/49776_2.png) [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\
**Post date:** [August 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186/3 "2021-08-02T09:32:35Z")

</div>

Thanks, let me try this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2021, 9:32am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186/4 "2021-08-30T09:32:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.