OpenSearch

Overview

Use OpenSearch credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	opensearch
Category	Search
Credential Type	Base64 Credentials

Step 1: Get Credentials

Create an internal user

Follow the OpenSearch access-control guide to create an internal user with the roles the integration needs (or use an existing one).

Encode the credentials

Base64-encode the credentials: echo -n 'username:password' | base64.

Paste the encoded string

Paste the encoded string into the credential field.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add OpenSearch

Go to Managed Secrets > Add Provider > OpenSearch.

Enter credentials

Paste your Base64 Credentials into the credential field.

Enter the deployment endpoint

Paste your Domain endpoint — copy it from the OpenSearch Service console (or use your self-managed cluster’s HTTPS host). Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach your deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-OPENSEARCH-HOST/my-index/_search",
    grant_id="YOUR_GRANT_ID",
    json={"query": {"match": {"title": "observability"}}, "size": 5},
)

Notes

• OpenSearch uses HTTP Basic authentication — the stored value is injected as Authorization: Basic <encoded>.
• Amazon OpenSearch Service domains that use IAM authentication should use the AWS (SigV4) template instead.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
search	read	POST	/_search
search_index	read	POST	/{index}/_search
msearch	read	POST	/_msearch
scroll	read	POST	/_search/scroll
clear_scroll	delete	DELETE	/_search/scroll
count	read	POST	/_count
count_index	read	POST	/{index}/_count
mget	read	POST	/_mget
get_doc	read	GET	/{index}/_doc/{id}
doc_exists	read	HEAD	/{index}/_doc/{id}
get_index	read	GET	/{index}
index_exists	read	HEAD	/{index}
get_mapping	read	GET	/{index}/_mapping
cat_indices	read	GET	/_cat/indices
cluster_health	read	GET	/_cluster/health
cluster_stats	read	GET	/_cluster/stats
index_doc	write	POST	/{index}/_doc
put_doc	write	PUT	/{index}/_doc/{id}
update_doc	write	POST	/{index}/_update/{id}
update_by_query	write	POST	/{index}/_update_by_query
bulk	delete, write	POST	/_bulk
bulk_index	delete, write	POST	/{index}/_bulk
create_index	write	PUT	/{index}
put_mapping	write	PUT	/{index}/_mapping
update_aliases	delete, write	POST	/_aliases
delete_doc	delete	DELETE	/{index}/_doc/{id}
delete_index	delete	DELETE	/{index}
delete_by_query	delete	POST	/{index}/_delete_by_query