@asfoorial I dont think there is any clean way of achieving this. Using The API will provide the full list of roles as you mentioned, which can then be used in a script to extract necessary roles. It is also possible to query security index . opendistro_security using curl with admin certs, however the source of the response will be base64 encoded. There might be a plugin available to decode this on the fly and query inside, but I’m not familiar with one.