# Elastic Fleet API Permissions

**URL:** <https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474>\
**Category:** Kibana\
**Tags:** fleet\
**Created:** [October 8, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474 "2024-10-08T17:54:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticfantastik](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\
**Post date:** [October 8, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474/1 "2024-10-08T17:54:10Z")

</div>

We have an elastic stack setup, along with fleet to manage our elastic agents. However, due to a number of technical reasons:

1. We have to manually deploy updates to certain agents.
2. We are limited to accessing Kibana only via url and we **do not have access directly to our Elasticsearch instance.**

Our goal is to be able to pull agent policies and secrets via using an API KEY to directly query Kibana, for example the /\_fleet api route. Unfortunately we are having issues with permissions, especially accessing fleet secrets. I know there are two ways of getting fleet secrets. The first is by directly querying the secret ID via:

```auto
https://our-kibana/api/console/proxy?path=_fleet/secret/{secret_id}&method=GET

```

The second way is to pull the entire `.fleet-secrets` index.

```auto
  curl -X POST "https://our-kibana/api/console/proxy?path=%2Efleet-secrets-7/_search&method=POST" \   
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey $API_KEY" \
  -d '{
    "query": {
      "match_all": {}
    }
  }'

```

We _are_ able to do both methods this if we generate a superuser API key. However, we aren't able to get the data ("Forbidden") if we create a restricted permission key. Here is our restricted API Key config:

```auto
{
  "read_fleet_secrets": {
    "cluster": [
      "monitor",
      "read_ilm"
    ],
    "indices": [
      {
        "names": [
          ".fleet-secrets",
          ".fleet-*"
        ],
        "privileges": [
          "read",
          "view_index_metadata",
          "read_cross_cluster",
          "all"
        ],
        "allow_restricted_indices": true
      }
    ],
    "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_fleet.read",
          "feature_security.read",
          "feature_management.read",
          "feature_discover.read",
          "manage_internal_index_patterns"
        ],
        "resources": [
          "*"
        ]
      },
      {
        "application": "fleet",
        "privileges": [
          "all"
        ],
        "resources": [
          "*"
        ]
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

```

We checked through elastic's documentation, however it's currently very limited on anything related to fleet api related calls.

We've seen that it might be necessary to be a superuser to use anything related to fleet (e.g. this older post: [What permissions are needed to manage Fleet/Agent Policies/Integrations](https://discuss.elastic.co/t/what-permissions-are-needed-to-manage-fleet-agent-policies-integrations/286650)). However, we were ideally hoping for a restricted set of permissions for our use case.

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 8, 2024, 7:20pm UTC](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474/2 "2024-10-08T19:20:55Z")

</div>

Have you checked this [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html)?

Fleet permissions are managed on Kibana, not on a elasticsearch role.

---

<div class="post-metadata">

**Author:** ![elasticfantastik](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\
**Post date:** [October 8, 2024, 8:16pm UTC](https://discuss.elastic.co/t/elastic-fleet-api-permissions/368474/3 "2024-10-08T20:16:44Z")

</div>

Thanks for your reply. Indeed I tried creating a fleet role, but I still get forbidden.