# Document Level Security: Query indices with and without ACL index in parallel by a single API key

**URL:** <https://discuss.elastic.co/t/document-level-security-query-indices-with-and-without-acl-index-in-parallel-by-a-single-api-key/343599>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [September 22, 2023, 7:42am UTC](https://discuss.elastic.co/t/document-level-security-query-indices-with-and-without-acl-index-in-parallel-by-a-single-api-key/343599 "2023-09-22T07:42:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastianboelling](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\
**Post date:** [September 22, 2023, 7:42am UTC](https://discuss.elastic.co/t/document-level-security-query-indices-with-and-without-acl-index-in-parallel-by-a-single-api-key/343599/1 "2023-09-22T07:42:11Z")

</div>

Hi,

I am investigating the new Document Level Security feature in combination with Search Applications.

[Leverage document-level security from connectors in Search Applications | Enterprise Search documentation [8.10] | Elastic](https://www.elastic.co/guide/en/enterprise-search/8.10/dls-e2e-guide.html#dls-e2e-guide-elasticsearch-querying-multiple-indices)

I am planning to query multiple indices. Some indices have content which should only be available to specific users and groups. We plan to use the ACL-indices for them. But some indices have content which is open and available to all users (e.g. crawled content). We don't have ACL indices for them.

I've found out that it is possible to create an API key via POST /\_security/api\_key which can combine multiple indices with DLS based on their specific ALC indices.

But can I create an API key which also includes indices which are "open" and don't have an ACL index?

So the single API key should grant access to both: indices with and without ACL indices.

Best regards

Sebastian

---

<div class="post-metadata">

**Author:** ![Carlos\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlos_d/32/126245_2.png) [@Carlos\_D](https://discuss.elastic.co/u/Carlos_D)\
**Post date:** [October 10, 2023, 3:20pm UTC](https://discuss.elastic.co/t/document-level-security-query-indices-with-and-without-acl-index-in-parallel-by-a-single-api-key/343599/2 "2023-10-10T15:20:33Z")

</div>

Hi @sebastianboelling :

You can create an API key with both DLS and non-DLS indices in mind:

```json
POST /_security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "role": {
      "index": [
        {
          "names": [
            "restricted-indices-*"
            ],
            "privileges": [
              "read"
              ],
              "query": {
                "template": {
                  "params": {
                    "access_control": [
                      "john@example.co",
                      "Engineering Members"
                      ]
                  },
                  "source": """
                  {
                    "bool": {
                      "filter": {
                        "bool": {
                          "should": [
                            {
                              "bool": {
                                "must_not": {
                                  "exists": {
                                    "field": "_allow_access_control"
                                  }
                                }
                              }
                            },
                            {
                              "terms": {
                                "_allow_access_control.enum": {
                                  {
                                    #
                                    toJson
                                  }
                                }
                                access_control
                                {
                                  {
                                    /toJson
                                  }
                                }
                              }
                            }
                            ]
                        }
                      }
                    }
                  }
                  """
                }
              }
        },
        {
          "names": [
            "public-indices-*"
            ],
            "privileges": [
              "read"
              ]
        }
        ],
        "restriction": {
          "workflows": [
            "search_application_query"
            ]
        }
    }
  }
}

```

You can see that different indices can have different security level.

You could as well create separate role descriptors for public and restricted content instead of having a single role with both index types - it's up to you for organizing indices into separate roles or combine them in a single role.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2023, 3:20pm UTC](https://discuss.elastic.co/t/document-level-security-query-indices-with-and-without-acl-index-in-parallel-by-a-single-api-key/343599/3 "2023-11-07T15:20:54Z")

</div>

Closed on November 7, 2023, 3:20pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.