Elasticsearch
Databasesystem_type: "elasticsearch"Proxy Elasticsearch REST API calls for index, search, and document operations with field-level encryption.
Overview#
The Elasticsearch connector proxies Elastic REST API v8 calls. API keys or username/password are sealed in QuantaVault. Supports document CRUD, search queries, index management, and aggregations.
https://api.quantaseal.io/api/v2/proxy/outboundAuth header:
X-API-Key: qs_live_…Prerequisites#
- 1An Elasticsearch cluster (self-hosted or Elastic Cloud)
- 2An API key or username/password with the required index privileges
- 3Cluster base URL
Configuration#
Follow these steps to connect Elasticsearch to QuantaSeal. You can configure integrations via the Admin Console or directly via the API.
- 1
In Kibana → Stack Management → API Keys, create an API key with the required index privileges.
- 2
Seal: POST /api/v2/vault/seal with credential_type: api_key.
- 3
Create integration with system_type: elasticsearch, config: {base_url: 'https://my-cluster.es.us-east-1.aws.elastic.cloud:9243'}.
Authentication Types#
Prefer API keys (seal as api_key). For username/password, use basic_auth credential type.
All credential types are sealed in QuantaVault with ML-KEM-768 + AES-256-GCM and wrapped by your tenant AWS KMS CMK before storage. See the Vault API reference for the full list of credential types and seal/unseal endpoints.
Available Operations#
QuantaSeal enforces a default-deny operation policy. Only operations listed in your integration's allowed_operations array will be permitted. Add operations when creating or updating the integration.
| Operation | Description |
|---|---|
search | Execute an Elasticsearch query DSL search. |
index_document | Index a single document. |
get_document | Retrieve a document by ID. |
delete_document | Delete a document by ID. |
bulk | Bulk index or update multiple documents. |
Code Example#
Every proxy call returns a HybridCryptoEnvelope - the response is ML-KEM-768 key-encapsulated, AES-256-GCM encrypted, and signed with ML-DSA-65 + HMAC-SHA-512. Verify both signatures before trusting the decrypted payload.
curl -X POST https://api.quantaseal.io/api/v2/proxy/outbound \
-H "X-API-Key: qs_live_your_key_here" \
-H "Content-Type: application/json" \
-d '{"integration_id":"int_ES001","operation":"search","payload":{"index":"customers","query":{"match":{"status":"active"}},"size":50}}'client.encryption.decrypt(envelope). Both the ML-DSA-65 signature and the HMAC-SHA-512 signature must pass - QuantaSeal uses a bitwise & check, not short-circuit and.Troubleshooting#
security_exception - missing required permissions
The API key lacks privileges for the index or operation. Update the API key in Kibana with the required index privilege (read, write, or manage).