# How to update user profile using API without \`manage\_security\` privilege
**URL:** https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545
**Category:** Kibana
**Created:** [August 21, 2022, 1:05pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545 "2022-08-21T13:05:57Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)
#### Post date: [August 21, 2022, 1:05pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545/1 "2022-08-21T13:05:57Z")
I am trying to update the `user` profile using **Flask** `API`
if `user` is logged in then he/she can update his profile fields `full name`, `email` only
when I trying to update `user` using `put_user`
```auto
#es=Elasticsearch instance
sscl = SecurityClient(es).put_user(**body)
```
but it throws an error `unauthorized user` because this `user` need `cluster privilege manage_security` but
**if I provide this `privilege` to logged in `user` then he/she can update other `users` profiles too**
is there any `method` to update the logged-in profile without granting the `manage_security`` privilege` to the `user`? so that `user` only only update his or her `profile`
or any other way?
---
### Author:  [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [August 22, 2022, 5:42am UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545/2 "2022-08-22T05:42:26Z")
Hi
The `manage_security` [cluster privilege](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/security-privileges.html#privileges-list-cluster) is required to access role management.
Here is the documentation for cluster privileges: [Security privileges | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/security-privileges.html#privileges-list-cluster)
But if the logged in user is trying to update their profile- it could be done via curl request to grant additional cluster privileges. ( the user should have the privilege to grant more permissions in the first place)
```auto
GET /_security/user/_has_privileges
POST /_security/user/_has_privileges
```
Determines whether the logged in user has a specified list of privileges.
ccing @Larry_Gregory for more inputs
thanks
Rashmi
---
### Author:  [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [August 22, 2022, 12:14pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545/3 "2022-08-22T12:14:17Z")
> [@Azhar\_Uddin1](#):
>
> is there any `method` to update the logged-in profile without granting the `manage_security` ` privilege` to the `user`? so that `user` only only update his or her `profile`
@Azhar_Uddin1 this is not possible today. The Elasticsearch privilege model does not offer this level of granularity at this time.
Within Kibana & ES, we are gradually introducing the concept of a more formal "User Profile", which will eventually allow end-users to customize properties such as their display name, and other preferences. This will be separate from the existing `put_user` (and related) APIs, however.
---
### Author:  [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)
#### Post date: [August 22, 2022, 2:39pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545/4 "2022-08-22T14:39:58Z")
Thanks, @Larry_Gregory I have created an issue on [Github](https://github.com/elastic/elasticsearch/issues/89508)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2022, 2:40pm UTC](https://discuss.elastic.co/t/how-to-update-user-profile-using-api-without-manage-security-privilege/312545/5 "2022-09-19T14:40:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.