# Creating a workspace using the API **URL:** \ **Category:** OpenSearch Dashboards\ **Created:** [April 9, 2026, 4:33pm UTC](https://forum.opensearch.org/t/creating-a-workspace-using-the-api/27979 "2026-04-09T16:33:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Ploef](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@Ploef](https://forum.opensearch.org/u/Ploef)\ **Post date:** [April 9, 2026, 4:33pm UTC](https://forum.opensearch.org/t/creating-a-workspace-using-the-api/27979/1 "2026-04-09T16:33:54Z")
**Versions** : 3.6.0 **Describe the issue** : I’m trying to create a Workspace using the API but keep getting the following error: ```auto OpenSearch Dashboards API POST /api/workspaces returned success=false. Details: no permissions for [indices:data/read/search] and User [name=dip-controlplane, backend_roles=[controlplane_role[], requestedTenant=null]: security_exception: [security_exception[] Reason: no permissions for [indices:data/read/search] and User [name=dip-controlplane, backend_roles=[controlplane_role], requestedTenant=null] ``` This is my current configuration for the controlplane\_role backend\_role: ```yaml controlplane_role: reserved: true description: "DIP controlplane service role" cluster_permissions: - "cluster:monitor/main" - "restapi:admin/roles" - "restapi:admin/rolesmapping" index_permissions: - index_patterns: - "ss4o_logs-*" - "dip-logs-*" allowed_actions: - "manage_aliases" - "indices:admin/aliases/get" - index_patterns: - ".kibana*" - ".opensearch_dashboards*" - ".opensearch-dashboards*" - ".plugins-workspace*" - ".plugins-ml-config" - ".ql-datasources*" - ".opensearch-observability*" allowed_actions: # Workspace management is implemented through Dashboards saved objects and # related system indices. Use full index access on this narrow set of # Dashboards-owned indices to avoid brittle per-action gaps. - "*" - "system:admin/system_index" - index_patterns: - "*" allowed_actions: - "indices:data/read/search" - "indices:admin/mappings/get" ``` ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/abbe250e2f86363a56895d75007225cc147ea09a.png) ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [April 10, 2026, 9:08am UTC](https://forum.opensearch.org/t/creating-a-workspace-using-the-api/27979/2 "2026-04-10T09:08:58Z")
@Ploef Could you share your opensearch.yml file? ---
**Author:** ![Ploef](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@Ploef](https://forum.opensearch.org/u/Ploef)\ **Post date:** [April 10, 2026, 10:23am UTC](https://forum.opensearch.org/t/creating-a-workspace-using-the-api/27979/3 "2026-04-10T10:23:11Z")
Hi @pablo, Thanks for the response. This is my current opensearch.yml content (or at least the part that might affect the problem) . ```yaml # TLS (required when Security plugin enabled) plugins.security.ssl.transport.pemcert_filepath: certs/transport/tls.crt plugins.security.ssl.transport.pemkey_filepath: certs/transport/tls.key plugins.security.ssl.transport.pemtrustedcas_filepath: certs/transport/ca.crt plugins.security.ssl.transport.enforce_hostname_verification: true plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert_filepath: certs/http/tls.crt plugins.security.ssl.http.pemkey_filepath: certs/http/tls.key plugins.security.ssl.http.pemtrustedcas_filepath: certs/http/ca.crt plugins.security.restapi.roles_enabled: ["all_access","security_rest_api_access","searchguard_role","controlplane_role"] plugins.security.system_indices.permission.enabled: true plugins.security.ssl.transport.enabled: true plugins.security.nodes_dn: - "CN=opensearch-transport" plugins.security.authcz.admin_dn: - "CN=admin" plugins.query.datasources.encryption.masterkey: ${OPENSEARCH_DATASOURCES_ENCRYPTION_MASTERKEY} plugins.security.disabled: false plugins.security.audit.type: internal_opensearch plugins.security.audit.config.enable_rest: true plugins.security.audit.config.enable_transport: true plugins.security.audit.config.disabled_rest_categories: NONE plugins.security.audit.config.disabled_transport_categories: NONE ``` ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [April 13, 2026, 6:20pm UTC](https://forum.opensearch.org/t/creating-a-workspace-using-the-api/27979/4 "2026-04-13T18:20:13Z")
@Ploef Thank you for sharing your opensearch.yml file. The issue was caused by a missing tenant permission. This root cause isn’t reported in the OpenSearch logs properly. I’ve found two solutions/workarounds 1. Add `kibanauser` backend role to your test user. This backend role already has built-in access to the Global tenant. Alternatively, add Global tenant permission to your custom role. ```auto curl --insecure -u pablo:Eliatra123 https://localhost:9200/_plugins/_security/authinfo?pretty { "user" : "User [name=pablo, backend_roles=[], requestedTenant=null]", "user_name" : "pablo", "user_requested_tenant" : null, "remote_address" : "172.19.0.1:40052", "backend_roles" : [], "custom_attribute_names" : [], "roles" : [ "pablo", "kibana_user", "own_index" ], "tenants" : { "pablo" : true, "global_tenant" : true }, "principal" : null, "peer_certificates" : "0", "sso_logout_url" : null } ``` 1. Follow OpenSearch documentation and disable multi-tenancy in OpenSearch (config.yml) and OpenSearch Dashboards (opensearch\_dashboards.yml ) > **[Enabling the Workspace feature - Workspace for OpenSearch Dashboards](https://docs.opensearch.org/latest/dashboards/workspace/workspace/#enabling-the-workspace-feature)** > > Workspace for OpenSearch Dashboards Introduced 2.18 > **[Multi-tenancy configuration](https://docs.opensearch.org/latest/security/multi-tenancy/multi-tenancy-config/)** > > Multi-tenancy configuration