OpenSearch

Overview

Use OpenSearch credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	opensearch
Category	Search
Credential Type	Base64 Credentials

Step 1: Get Credentials

Create an internal user

Follow the OpenSearch access-control guide to create an internal user with the roles the integration needs (or use an existing one).

Encode the credentials

Base64-encode the credentials: echo -n 'username:password' | base64.

Paste the encoded string

Paste the encoded string into the credential field.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add OpenSearch

Go to Managed Secrets > Add Provider > OpenSearch.

Enter credentials

Paste the Base64 Credentials into the credential field.

Enter the deployment endpoint

Paste the Domain endpoint. Copy it from the OpenSearch Service console (or use a self-managed cluster’s HTTPS host). Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach the deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-OPENSEARCH-HOST/my-index/_search",
    grant_id="YOUR_GRANT_ID",
    json={"query": {"match": {"title": "observability"}}, "size": 5},
)

Notes

• OpenSearch uses HTTP Basic authentication — the stored value is injected as Authorization: Basic <encoded>.
• Amazon OpenSearch Service domains that use IAM authentication should use the AWS (SigV4) template instead.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
search	read	POST	/_search	—
search_index	read	POST	/{index}/_search	—
msearch	read	POST	/_msearch	—
scroll	read	POST	/_search/scroll	—
clear_scroll	delete	DELETE	/_search/scroll	—
count	read	POST	/_count	—
count_index	read	POST	/{index}/_count	—
mget	read	POST	/_mget	—
get_doc	read	GET	/{index}/_doc/{id}	—
doc_exists	read	HEAD	/{index}/_doc/{id}	—
get_index	read	GET	/{index}	—
index_exists	read	HEAD	/{index}	—
get_mapping	read	GET	/{index}/_mapping	—
cat_indices	read	GET	/_cat/indices	—
cluster_health	read	GET	/_cluster/health	—
cluster_stats	read	GET	/_cluster/stats	—
index_doc	write	POST	/{index}/_doc	—
put_doc	write	PUT	/{index}/_doc/{id}	—
update_doc	write	POST	/{index}/_update/{id}	—
update_by_query	write	POST	/{index}/_update_by_query	—
bulk	delete, write	POST	/_bulk	—
bulk_index	delete, write	POST	/{index}/_bulk	—
create_index	write	PUT	/{index}	—
put_mapping	write	PUT	/{index}/_mapping	—
update_aliases	delete, write	POST	/_aliases	—
delete_doc	delete	DELETE	/{index}/_doc/{id}	—
delete_index	delete	DELETE	/{index}	—
delete_by_query	delete	POST	/{index}/_delete_by_query	—
security.authtoken.0	admin	POST	/_plugins/_security/api/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.authtoken.0_superseded	admin	POST	/_opendistro/_security/api/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.generate_obo_token.0	admin	POST	/_plugins/_security/api/generateonbehalfoftoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.generate_user_token.0	admin	POST	/_plugins/_security/api/internalusers/{username}/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.generate_user_token.0_superseded	admin	POST	/_opendistro/_security/api/internalusers/{username}/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.generate_user_token_legacy.0	admin	POST	/_plugins/_security/api/user/{username}/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.generate_user_token_legacy.0_superseded	admin	POST	/_opendistro/_security/api/user/{username}/authtoken	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.change_password.0	admin	PUT	/_plugins/_security/api/account	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
security.change_password.0_superseded	admin	PUT	/_opendistro/_security/api/account	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)