security_exception: security_exception: unable to authenticate / action [...] is unauthorized for user [...] (HTTP 401/403)

What does it mean?

Authentication (401 Unauthorized) or authorization (403 Forbidden) failed. 401 indicates missing/incorrect credentials; 403 indicates the user is authenticated but lacks the required role/privilege for this action/index.

Why does it happen?

Wrong username/password or API key, a missing Authorization header, an expired/invalid token, the user lacking the relevant index or cluster privilege, or a missing/incorrect role assignment.

How to fix it

For 401: send the correct credentials/API key and check the Authorization header. For 403: inspect the user's roles and privileges (GET _security/user/app_user, GET _security/role/app_role) and add the required index/cluster privileges. Follow the principle of least privilege. If you use an API key, verify its expiration and permissions.