# How are "applications" supposed to be used in context of the create/update application privileges api? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [April 8, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594 "2021-04-08T12:50:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![fletches](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@fletches](https://discuss.elastic.co/u/fletches)\ **Post date:** [April 8, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/1 "2021-04-08T12:50:19Z")
I'm new to Elasticsearch. We have the need for multiple applications to share the same cluster and restrict indices privileges to those owned by that team. I see the application api to create/update application privileges in the reference doc. The application name, privilege name, action name appear to be any value we want as long as conforming to naming rules, but there is no context offered as to the use case for creating application privileges. I'm looking for plain language background on the concept of applications and when they should be used. It might not be applicable to my need but still would like to understand how application definitions should be used. I can find no explanation in the doc or with google. Thanks for your help. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 12, 2021, 4:28am UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/2 "2021-04-12T04:28:13Z")
Welcome to our community! 😃 Can you clarify what you mean by the applications API? A link would be good, so we are on the same page. ---
**Author:** ![fletches](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@fletches](https://discuss.elastic.co/u/fletches)\ **Post date:** [April 12, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/3 "2021-04-12T12:27:45Z")
Hi Mark thanks for your reply. I tried posting a link initially but the forum page said pastes are not allowed which is frustrating for long hyperlinks. Here is the api I'm referring to (typing it all in): > **[Create or update application privileges API | Elasticsearch Guide \[7.12\] |...](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-privileges.html)** Again looking for background context in how this api should be used. Thanks much. - ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 13, 2021, 5:50am UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/4 "2021-04-13T05:50:20Z")
Thanks for that, to be honest I have never seen it, so let me see if I can find someone that can help 🙂 ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 13, 2021, 8:25am UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/5 "2021-04-13T08:25:47Z")
You don't want application privileges. For the use case you have, you almost certainly want to have a "user" per application (or perhaps several users) and grant each user a role that restricts them to the relevant indices, through the ["indices" section of the role](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv). As far as application privileges are concerned, from [Security privileges | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#application-privileges) > Application privileges are managed within Elasticsearch and can be retrieved with the [has privileges API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-has-privileges.html) and the [get application privileges API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-privileges.html). They do not, however, grant access to any actions or resources within Elasticsearch. Their purpose is to enable applications to represent and store their own privilege models within Elasticsearch roles. Application privileges are a way for applications that are built on top of Elasticsearch to use Elasticsearch's security model to implement access control for resources that exist within that application. You only want to do that if you are building something that is very tightly integrated with Elasticsearch (e.g. Kibana). ---
**Author:** ![fletches](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@fletches](https://discuss.elastic.co/u/fletches)\ **Post date:** [April 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/6 "2021-04-21T21:01:22Z")
Thanks very much for your reply. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 19, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594/7 "2021-05-19T21:01:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.