# Security\_exception - action \[cluster:monitor/main\] is unauthorized for user \[p595200\]

**URL:** https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-p595200/107756
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 15, 2017, 1:34pm UTC](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-p595200/107756 "2017-11-15T13:34:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)
#### Post date: [November 15, 2017, 1:34pm UTC](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-p595200/107756/1 "2017-11-15T13:34:55Z")

</div>

When we try to hit ES directly with a header, we are getting the below 403 response.

Can someone please let me know what could be the issue.

{"error":{"root\_cause":[{"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [p595200]"}],"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [p595200]"},"status":403}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd0823799dc1efa3677fb098ba55c140f2ec8204.png)

---

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 15, 2017, 8:41pm UTC](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-p595200/107756/2 "2017-11-15T20:41:29Z")

</div>

I hate to state the obvious, but the user `p595200` does not have permission to perform that action.  
Your user is being correctly authenticated, but their roles don't give them the necessary permissions to perform the request.

`cluster:monitor/main` is the action that is at the root ("/") URL of the cluster that prints out the version number and cluster health etc.

The possible causes are:

- The user has _no_ roles -\> How are you assigning roles to users?
- The user is missing a role that it should have
- One of the users roles is missing cluster privileges that it should have.

You should start by using the [`_authenticate` API](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/security-api-authenticate.html), which will show you the details of the user you are using, including their assigned roles.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 13, 2017, 8:41pm UTC](https://discuss.elastic.co/t/security-exception-action-cluster-monitor-main-is-unauthorized-for-user-p595200/107756/3 "2017-12-13T20:41:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.