---
title: "Create or update a role"
method: PUT
path: "/api/security/role/{name}"
tags: ["roles"]
---

# Create or update a role

`PUT /api/security/role/{name}`

Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.

## Path parameters

- `name` string, required

## Query parameters

- `createOnly` boolean

## Headers

- `kbn-xsrf` string, required

## Request body

- KibanaHTTPAPIsSecurityRolePutPayload — The role definition to create or update.
  - `description` string — A description for the role.
  - `elasticsearch` KibanaHTTPAPIsSecurityRoleElasticsearch, required — The Elasticsearch cluster, index, and remote cluster security privileges for the role.
    - `cluster` string[]
    - `indices` KibanaHTTPAPIsSecurityRoleIndicesPrivileges[]
      - `allow_restricted_indices` boolean — Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.
      - `field_security` object
      - `names` string[], required
      - `privileges` string[], required
      - `query` string — A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
    - `remote_cluster` KibanaHTTPAPIsSecurityRoleRemoteClusterPrivileges[]
      - `clusters` string[], required
      - `privileges` string[], required
    - `remote_indices` KibanaHTTPAPIsSecurityRoleRemoteIndicesPrivileges[]
      - `allow_restricted_indices` boolean — Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.
      - `clusters` string[], required
      - `field_security` object
      - `names` string[], required
      - `privileges` string[], required
      - `query` string — A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
    - `run_as` string[]
  - `kibana` KibanaHTTPAPIsSecurityRoleKibanaPrivilege[]
    - `base` union, required
      - string[]
      - string[]
    - `feature` object
    - `spaces` union
      - string[]
      - string[]
  - `metadata` object

## Response `204`

Indicates a successful call.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)