# Elasticsearch: Create API Key based on role?
**URL:** https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [February 14, 2022, 7:49pm UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188 "2022-02-14T19:49:05Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [February 14, 2022, 7:49pm UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188/1 "2022-02-14T19:49:05Z")
In the [Create API key API documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html#security-api-create-api-key), it shows the complete role definition for the API key being included in the `/_security/api_key` request.
However, in the example shown, supposed I already have `role-a` and `role-b` defined as user roles. Is there a way to create the API key based on those previously-defined roles, without having to completely recreate them in the key?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 15, 2022, 1:38am UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188/2 "2022-02-15T01:38:19Z")
No that is not possible.
Although API Keys use the same JSON format as roles, they operate quite differently.
Although it would sometime be convenient to use an existing role to describe a new API Key, it would be misleading - the API Key would not be tied to the role in any way, it would simply be a convenience to copy the current permissions from that role into the new API Key.
We have discussed whether we should offer that sort of convenience feature, but we feel that it would create too much confusion - most people would be surprised to find that changes to the roles would not be reflected in permissions of the API key.
---
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [February 15, 2022, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188/4 "2022-02-15T15:31:46Z")
> [@TimV](#):
>
> No that is not possible.
>
> Although API Keys use the same JSON format as roles, they operate quite differently.
Thanks. That's not what I hoped to hear, but it is what I expected to hear. It's not a major issue, since I can always retrieve a role and include it as a `role_descriptor` when generating an API key, and since I generate my API keys as an admin user, they should always have the exact permissions I anticpate. Or at least they always have so far.
> [@TimV](#):
>
> We have discussed whether we should offer that sort of convenience feature, but we feel that it would create too much confusion - most people would be surprised to find that changes to the roles would not be reflected in permissions of the API key.
The [request body](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html#security-api-create-api-key-request-body) portion of the [Create API key API documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html) is fairly clear regarding pinning permissions to a snapshot of the current user permissions:
> `role_descriptors`
> (Optional, array-of-role-descriptor) An array of role descriptors for this API key. This parameter is optional. When it is not specified or is an empty array, then the API key will have a _point in time snapshot of permissions of the authenticated user_ . If you supply role descriptors then the resultant permissions would be an intersection of API keys permissions and authenticated user’s permissions thereby limiting the access scope for API keys. The structure of role descriptor is the same as the request for create role API. For more details, see [create or update roles API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role.html).
If you were to allow an API key to be mapped to a point-in-time snapshot of role permissions **and** were to use similar wording, it should be clear enough, IMO.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2022, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-create-api-key-based-on-role/297188/5 "2022-03-15T15:32:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.