elasticsearch/x-pack/docs/en/rest-api/security/enroll-kibana.asciidoc

[[security-api-kibana-enrollment]]
=== Enroll {kib} API
++++
<titleabbrev>Enroll {kib}</titleabbrev>
++++

Enables a {kib} instance to configure itself for communication with a secured {es} cluster.

[[security-api-kibana-enrollment-request]]
==== {api-request-title}

`GET /_security/enroll/kibana`

[[security-api-kibana-enrollment-desc]]
==== {api-description-title}

Use this API to enable a {kib} instance to configure itself for communications
with an {es} cluster that already has security features enabled.

[[security-api-client-enrollment-examples]]
==== {api-examples-title}

The following example shows how to enroll a {kib} instance.

[source,console]
----
GET /_security/enroll/kibana
----
// TEST[skip:we need to enable HTTP TLS for the docs cluster]

The API returns the following response:

[source,console_result]
----
{
  "password" : "longsecurepassword", <1>
  "http_ca" : "MIIJlAIBAzCCCVoGCSqGSIb3....vsDfsA3UZBAjEPfhubpQysAICCAA=", <2>
}
----
<1> The password for the `kibana_system` user.
<2> The CA certificate used to sign the node certificates that {es} uses for TLS on the HTTP layer.
The certificate is returned as a Base64 encoded string of the ASN.1 DER encoding of the certificate.