Configure Kibana API route authorization with requiredPrivileges and privilege-based branching.
npx skills add https://github.com/elastic/kibana --skill api-authz
Please help me install this Agent Skill. Skill: api-authz Source: https://github.com/elastic/kibana/tree/main/.agents/skills/api-authz Command: npx skills add https://github.com/elastic/kibana --skill api-authz
This Skill ensures that all API routes within Kibana are properly secured with authorization checks, preventing unauthorized access to sensitive data and functionality.
requiredPrivileges.<operation>_<subject> format for clear and maintainable privilege definitions.request.authzResult.Configure the '/api/users' route to require the 'admin_users' privilege for access.
High-intent search queries and answers about installing and using this skill.
To secure Kibana API routes, you define authorization requirements using the `requiredPrivileges` property in your route configuration. This mandates that only users with specified privileges can access the endpoint, preventing unauthorized access to sensitive data and functionality.
The correct naming convention for custom Kibana privileges is the `<operation>_<subject>` format. This structure ensures privilege definitions remain clear and maintainable across your codebase, such as defining an administrative privilege like `admin_users` for a user management endpoint.
Yes, you can implement conditional logic in Kibana routes based on user privileges using the `request.authzResult` object. This enables dynamic route behavior, allowing your API to branch its execution path depending on the specific privileges the authenticated user currently holds.
Yes, it is possible to opt out of authorization for a specific Kibana API route when necessary. The skill provides mechanisms to safely disable authorization checks, although you must provide clear reasons to maintain adherence to established security best practices.
All Kibana API routes need authorization configuration to prevent unauthorized access to sensitive data and functionality. Mandating authorization checks ensures adherence to security best practices across the platform, blocking unauthenticated interactions with your endpoints by default.
cwinvestmentsAudit Next.js API routes for authentication, authorization, and input validation vulnerabilities.
twhitehead-blackdogManages user permissions and roles with route protection and UI rendering via PermissionsService and guard.
sandeeep-prajapatiImplement role-based authentication and authorization in Laravel using Sanctum.
zebbernEnumerate Windows privileges and misconfigurations to identify privilege escalation vectors.