elasticsearch/x-pack/docs/en/rest-api/security/get-service-credentials.asciidoc

[role="xpack"]
[[security-api-get-service-credentials]]
=== Get service account credentials API

beta::[]

++++
<titleabbrev>Get service account credentials</titleabbrev>
++++

Retrieves all service credentials for a  <<service-accounts,service account>>.

[[security-api-get-service-credentials-request]]
==== {api-request-title}

`GET /_security/service/<namespace>/<service>/credential`

[[security-api-get-service-credentials-prereqs]]
==== {api-prereq-title}

* To use this API, you must have at least the `manage_service_account`
<<privileges-list-cluster,cluster privilege>>.

[[security-api-get-service-credentials-desc]]
==== {api-description-title}
include::../../security/authentication/service-accounts.asciidoc[tag=service-accounts-tls]

Use this API to retrieve a list of credentials for a service account. 
The response includes service account tokens that were created with the
<< create service account API >> as well as file-backed tokens that
are local to the node.

NOTE: For tokens backed by the `service_tokens` file, the API only returns
tokens defined in the file local to the node against which the request was issued.

[[security-api-get-service-credentials-path-params]]
==== {api-path-parms-title}

`namespace`::
(Required, string) Name of the namespace.

`service`::
(Required, string) Name of the service name.

[[security-api-get-service-credentials-example]]
==== {api-examples-title}
The following request uses the <<security-api-create-service-token,create service account token API>> to create a service account token named `token1`
in the `elastic/fleet-server` service account:

[source,console]
----
POST /_security/service/elastic/fleet-server/credential/token/token1
----

The following request returns all credentials for the `elastic/fleet-server`
service account:

[source,console]
----
GET /_security/service/elastic/fleet-server/credential
----
// TEST[continued]

The response includes all credentials related to the specified service account:

[source,js]
----
{
  "service_account": "elastic/fleet-server",
  "node_name": "node0", <1>
  "count": 3,
  "tokens": {
    "token1": {},       <2>
    "token42": {}       <3>
  },
  "file_tokens": {
    "my-token": {}      <4>
  }
}
----
// NOTCONSOLE
<1> The local node name
<2> A new service account token backed by the `.security` index
<3> An existing service account token backed by the `.security` index
<4> A file-backed token local to the `node0` node