# Failed to determine the health of the cluster when creating enrollment token
**URL:** https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679
**Category:** Elasticsearch
**Created:** [June 18, 2024, 8:05pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679 "2024-06-18T20:05:25Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@HallMonitor](https://discuss.elastic.co/u/HallMonitor)
#### Post date: [June 18, 2024, 8:05pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/1 "2024-06-18T20:05:25Z")
```auto
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
ERROR: Failed to determine the health of the cluster. , with exit code 69
```
Only configuration change so far is the setup of ReadOnlyRest.
bellow is the result of requesting health manually
```auto
{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 32,
"active_shards" : 32,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 2,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 94.11764705882352
}
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 19, 2024, 3:57am UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/2 "2024-06-19T03:57:41Z")
> [@HallMonitor](#):
>
> Only configuration change so far is the setup of ReadOnlyRest.
I'd be very surprised if enrollment works with ReadOnlyRest - we certainly don't test or support it.
The enrollment token functionality is only designed to work with Elasticsearch security.
Is there a particular reason you're using ROR instead of the builtin security features of Elasticsearch?
---
### Author:  [@HallMonitor](https://discuss.elastic.co/u/HallMonitor)
#### Post date: [June 19, 2024, 1:11pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/3 "2024-06-19T13:11:17Z")
Ror shouldn't impact cluster functionality.
I would prefer not to comment on organization decisions
---
### Author:  [@HallMonitor](https://discuss.elastic.co/u/HallMonitor)
#### Post date: [June 19, 2024, 1:30pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/4 "2024-06-19T13:30:19Z")
Upon Clean install
```auto
user@host:~$ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
13:25:13.425 [main] ERROR org.elasticsearch.xpack.security.enrollment.ExternalEnrollmentTokenGenerator - Error 400when calling GET http://x.x.x.x:9200/_security/api_key. ResponseBody: {error=no handler found for uri [/_security/api_key] and method [POST]}
Unable to create enrollment token for scope [node]
ERROR: Unexpected response code [400] from calling POST http://x.x.x.x:9200/_security/api_key, with exit code 73
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 19, 2024, 11:47pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/5 "2024-06-19T23:47:32Z")
> [@HallMonitor](#):
>
> Ror shouldn't impact cluster functionality.
Read Only Rest is a third party plugin that replaces core functionality from Elasticsearch. If you choose to use Read Only Rest instead of Elasticsearch's built in security features then you lose the ability to use those builtin features, which includes automated enrollment.
I don't think you have any chance of making this work.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 19, 2024, 11:48pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-when-creating-enrollment-token/361679/6 "2024-06-19T23:48:42Z")
> [@HallMonitor](#):
>
> `13:25:13.425 [main] ERROR org.elasticsearch.xpack.security.enrollment.ExternalEnrollmentTokenGenerator - Error 400when calling GET http://x.x.x.x:9200/_security/api_key. ResponseBody: {error=no handler found for uri [/_security/api_key] and method [POST]}`
That looks like an install where security has been disabled, if so, then that is not a clean install.