OpenSearch API (user credentials)

Call the OpenSearch REST API with named user or service-account credentials at https://{stack-id}-es-user.logit.io. Permissions match your Teams OpenSearch roles — the same roles that apply in OpenSearch Dashboards.

Legacy stack API key access on {stack-id}-es.logit.io is unchanged. Use that endpoint when you need full programmatic access with the stack key. Use -es-user when you want requests scoped to a person or CI identity.

⚠️

Different credentials from -es. The -es-user endpoint does not accept your stack API key or Basic auth with stack ID + stack key. Use the OpenSearch API username and password from Profile settings (humans) or Account Settings → service accounts (CI). Those values are separate from @opensearch.username / @opensearch.password / @opensearch.apiKey.

Available on Business and Custom plans. The stack must use the OpenSearch HTTP API.

When signed in, examples auto-fill @esUser.* only if the feature is enabled on your selected stack and you have opted in from Profile (or you are viewing service-account docs separately). Until then, placeholder text remains.

Choose this endpoint when

Use case	Endpoint
Full stack API access (ingest, admin scripts, stack key)	`{stack-id}-es.logit.io` — Connect to Your Cluster
Per-user or service-account access (Teams roles apply)	`{stack-id}-es-user.logit.io` — this guide
Read-only AI tooling (Cursor / Claude)	`{stack-id}-mcp.logit.io` — Hosted OpenSearch MCP

Prerequisites

Account on a Business or Custom plan.
A Logs or OpenSearch stack with OpenSearch HTTP API available.
A stack administrator enables the feature on that stack.
For human access: the user has Teams access to the stack, then opts in from Profile settings.

Enable on a stack (administrator)

Open the stack Settings page (Overview).
In Access, find OpenSearch API (user credentials).
Select Enable.

Logit.io provisions the public hostname {stack-id}-es-user.logit.io. Legacy {stack-id}-es.logit.io continues to work with the stack API key.

Disable from the same Access card when you no longer need user-credential access on that stack.

Human users (Profile)

Each user creates their own Basic auth password from Profile settings:

Sign in and open Profile settings.
Under OpenSearch API (user credentials), select Enable OpenSearch API access for the account.
Copy the username (your user ID) and password shown after opt-in.
Use those credentials against every stack where a stack administrator has enabled the feature and you have Teams access.

You can rotate or disable your personal credential from the same Profile section. Rotating invalidates the previous password immediately. Disabling removes your Basic auth access; OpenSearch Dashboards access is unchanged.

Service accounts (CI / automation)

Account administrators manage service accounts under Account Settings → OpenSearch API (user credentials):

Create a service account with a name and an OpenSearch role (for example stack_user_ro).
Optionally scope it to one enabled stack, or leave the scope empty for all stacks with the feature enabled.
Copy the username (svc-{id}) and password from the credentials block.
Rotate password or Revoke when credentials should change or be retired.

Service accounts are intended for pipelines and automation that should not share a human user's password.

Connect with curl

Use the OpenSearch API (user credentials) username and password — not the stack -es credentials.

Field	Humans (Profile)	Service accounts	Stack `-es` (do not use here)
Username	Your user ID (`@esUser.username`)	`svc-{id}`	Stack ID (`@opensearch.username`)
Password	Profile opt-in password (`@esUser.password`)	Service account password	Stack API key (`@opensearch.password` / `@opensearch.apiKey`)
Host	`@esUser.endpointAddress`	Same	`@opensearch.endpointAddress`

curl -u "@esUser.username:@esUser.password" \
  "@esUser.endpointAddress/_cluster/health?pretty"

Search example:

curl -u "@esUser.username:@esUser.password" \
  -H "Content-Type: application/json" \
  "@esUser.endpointAddress/{index}/_search?pretty" \
  -d '{"query":{"match_all":{}},"size":10}'

Ports 443 and 9200 both use HTTPS, same as the stack -es endpoint.

Compared with the stack API key (`-es`)

	Stack API key (`-es`)	User credentials (`-es-user`)
Hostname	`{stack-id}-es.logit.io`	`{stack-id}-es-user.logit.io`
Auth	API key query param or Basic (stack ID + stack key)	Basic (user ID or `svc-{id}` + password)
Permissions	Full programmatic access to the stack's data	Matches Teams OpenSearch roles
Who manages credentials	Stack Endpoints / API keys	Profile (humans) or Account Settings (service accounts)
Plan	All plans with OpenSearch API	Business and Custom

Troubleshooting

Symptom	What to check
401 Unauthorized	Feature enabled on the stack? Profile opt-in complete (or service account created)? Username/password correct after a rotate?
403 Forbidden	Teams OpenSearch role may deny the operation (for example read-only users cannot index). Confirm roles under Account Settings → Teams.
DNS / connection failed	Feature may be disabled on the stack, or DNS/CNAME not ready yet — wait a minute and retry, or re-enable from Access.
Works on `-es` but not `-es-user`	Expected if you are using the stack API key on `-es`. Use Profile or service-account credentials on `-es-user`.

Next steps

Connect to Your Cluster — stack API key on -es
Hosted OpenSearch MCP — read-only AI clients
Managing OpenSearch & Grafana Security Roles
Managed Stack Limitations

Connect to Your Cluster Hosted OpenSearch MCP