Authz info for a number of REST api routes owned by Kibana Management team (#204682)

## Summary

Part of https://github.com/elastic/kibana/issues/204681

Simply adding authz info

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_create_route.ts

@@ -29,6 +29,12 @@ export const registerCreateRoute = ({
   router.post(
     {
       path: addBasePath('/auto_follow_patterns'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_delete_route.ts

@@ -25,6 +25,12 @@ export const registerDeleteRoute = ({
   router.delete(
     {
       path: addBasePath('/auto_follow_patterns/{id}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_fetch_route.ts

@@ -20,6 +20,12 @@ export const registerFetchRoute = ({
   router.get(
     {
       path: addBasePath('/auto_follow_patterns'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_get_route.ts

@@ -26,6 +26,12 @@ export const registerGetRoute = ({
   router.get(
     {
       path: addBasePath('/auto_follow_patterns/{id}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_pause_route.ts

@@ -24,6 +24,12 @@ export const registerPauseRoute = ({
   router.post(
     {
       path: addBasePath('/auto_follow_patterns/{id}/pause'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_resume_route.ts

@@ -24,6 +24,12 @@ export const registerResumeRoute = ({
   router.post(
     {
       path: addBasePath('/auto_follow_patterns/{id}/resume'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/auto_follow_pattern/register_update_route.ts

@@ -33,6 +33,12 @@ export const registerUpdateRoute = ({
   router.put(
     {
       path: addBasePath('/auto_follow_patterns/{id}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
         body: bodySchema,

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_permissions_route.ts

@@ -19,6 +19,12 @@ export const registerPermissionsRoute = ({
   router.get(
     {
       path: addBasePath('/permissions'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_stats_route.ts

@@ -20,6 +20,12 @@ export const registerStatsRoute = ({
   router.get(
     {
       path: addBasePath('/stats/auto_follow'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_create_route.ts

@@ -39,6 +39,12 @@ export const registerCreateRoute = ({
   router.post(
     {
       path: addBasePath('/follower_indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_fetch_route.ts

@@ -20,6 +20,12 @@ export const registerFetchRoute = ({
   router.get(
     {
       path: addBasePath('/follower_indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_get_route.ts

@@ -25,6 +25,12 @@ export const registerGetRoute = ({
   router.get(
     {
       path: addBasePath('/follower_indices/{id}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_pause_route.ts

@@ -22,6 +22,12 @@ export const registerPauseRoute = ({
   router.put(
     {
       path: addBasePath('/follower_indices/{id}/pause'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_resume_route.ts

@@ -22,6 +22,12 @@ export const registerResumeRoute = ({
   router.put(
     {
       path: addBasePath('/follower_indices/{id}/resume'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_unfollow_route.ts

@@ -22,6 +22,12 @@ export const registerUnfollowRoute = ({
   router.put(
     {
       path: addBasePath('/follower_indices/{id}/unfollow'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/cross_cluster_replication/server/routes/api/follower_index/register_update_route.ts

@@ -38,6 +38,12 @@ export const registerUpdateRoute = ({
   router.put(
     {
       path: addBasePath('/follower_indices/{id}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
         body: bodySchema,

x-pack/platform/plugins/private/grokdebugger/server/routes/api/grokdebugger/register_grok_simulate_route.ts

@@ -26,6 +26,12 @@ export function registerGrokSimulateRoute(framework: KibanaFramework) {
     {
       method: 'post',
       path: '/api/grokdebugger/simulate',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: requestBodySchema,
       },

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/index/register_add_policy_route.ts

@@ -39,7 +39,16 @@ export function registerAddPolicyRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/index/add'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/index/add'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const body = request.body as typeof bodySchema.type;
       const { indexName, policyName, alias = '' } = body;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/index/register_remove_route.ts

@@ -33,7 +33,16 @@ export function registerRemoveRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/index/remove'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/index/remove'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const body = request.body as typeof bodySchema.type;
       const { indexNames } = body;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/index/register_retry_route.ts

@@ -30,7 +30,16 @@ const bodySchema = schema.object({
 
 export function registerRetryRoute({ router, license, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/index/retry'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/index/retry'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const body = request.body as typeof bodySchema.type;
       const { indexNames } = body;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/nodes/register_details_route.ts

@@ -36,7 +36,16 @@ export function registerDetailsRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/nodes/{nodeAttrs}/details'), validate: { params: paramsSchema } },
+    {
+      path: addBasePath('/nodes/{nodeAttrs}/details'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: paramsSchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const params = request.params as typeof paramsSchema.type;
       const { nodeAttrs } = params;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts

@@ -85,7 +85,16 @@ export function registerListRoute({
   const disallowedNodeAttributes = [...NODE_ATTRS_KEYS_TO_IGNORE, ...filteredNodeAttributes];
 
   router.get(
-    { path: addBasePath('/nodes/list'), validate: false },
+    {
+      path: addBasePath('/nodes/list'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (context, request, response) => {
       try {
         const esClient = (await context.core).elasticsearch.client;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/policies/register_create_route.ts

@@ -50,7 +50,16 @@ export function registerCreateRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/policies'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const body = request.body as typeof bodySchema.type;
       const { name, ...rest } = body;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/policies/register_delete_route.ts

@@ -30,7 +30,16 @@ export function registerDeleteRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.delete(
-    { path: addBasePath('/policies/{policyNames}'), validate: { params: paramsSchema } },
+    {
+      path: addBasePath('/policies/{policyNames}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: paramsSchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const params = request.params as typeof paramsSchema.type;
       const { policyNames } = params;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts

@@ -60,7 +60,16 @@ async function fetchPolicies(client: ElasticsearchClient): Promise<TransportResu
 
 export function registerFetchRoute({ router, license, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/policies'), validate: false },
+    {
+      path: addBasePath('/policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (context, request, response) => {
       const { asCurrentUser } = (await context.core).elasticsearch.client;
 

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/snapshot_policies/register_fetch_route.ts

@@ -10,7 +10,16 @@ import { addBasePath } from '../../../services';
 
 export function registerFetchRoute({ router, license, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/snapshot_policies'), validate: false },
+    {
+      path: addBasePath('/snapshot_policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (context, request, response) => {
       try {
         const esClient = (await context.core).elasticsearch.client;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/snapshot_repositories/register_fetch_route.ts

@@ -16,7 +16,16 @@ import { handleEsError } from '../../../shared_imports';
 
 export const registerFetchRoute = ({ router, license }: RouteDependencies) => {
   router.get(
-    { path: addBasePath('/snapshot_repositories'), validate: false },
+    {
+      path: addBasePath('/snapshot_repositories'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     async (ctx, request, response) => {
       if (!license.isCurrentLicenseAtLeast(MIN_SEARCHABLE_SNAPSHOT_LICENSE)) {
         return response.forbidden({

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts

@@ -101,7 +101,16 @@ export function registerAddPolicyRoute({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/template'), validate: { body: bodySchema, query: querySchema } },
+    {
+      path: addBasePath('/template'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema, query: querySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const body = request.body as typeof bodySchema.type;
       const { templateName, policyName, aliasName } = body;

x-pack/platform/plugins/private/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts

@@ -84,7 +84,16 @@ const querySchema = schema.object({
 
 export function registerFetchRoute({ router, license, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/templates'), validate: { query: querySchema } },
+    {
+      path: addBasePath('/templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { query: querySchema },
+    },
     license.guardApiRoute(async (context, request, response) => {
       const isLegacy = (request.query as TypeOf<typeof querySchema>).legacy === 'true';
       try {

x-pack/platform/plugins/private/painless_lab/server/routes/api/execute.ts

@@ -17,6 +17,12 @@ export function registerExecuteRoute({ router, license }: RouteDependencies) {
   router.post(
     {
       path: `${API_BASE_PATH}/execute`,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/remote_clusters/server/routes/api/add_route.ts

@@ -95,6 +95,12 @@ export const register = (deps: RouteDependencies): void => {
   router.post(
     {
       path: API_BASE_PATH,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodyValidation,
       },

x-pack/platform/plugins/private/remote_clusters/server/routes/api/delete_route.ts

@@ -140,6 +140,12 @@ export const register = (deps: RouteDependencies): void => {
   router.delete(
     {
       path: `${API_BASE_PATH}/{nameOrNames}`,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsValidation,
       },

x-pack/platform/plugins/private/remote_clusters/server/routes/api/get_route.ts

@@ -103,6 +103,12 @@ export const register = (deps: RouteDependencies): void => {
   router.get(
     {
       path: API_BASE_PATH,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     licensePreRoutingFactory(deps, allHandler)

x-pack/platform/plugins/private/remote_clusters/server/routes/api/update_route.ts

@@ -108,6 +108,12 @@ export const register = (deps: RouteDependencies): void => {
   router.put(
     {
       path: `${API_BASE_PATH}/{name}`,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsValidation,
         body: bodyValidation,

x-pack/platform/plugins/private/rollup/server/routes/api/indices/register_get_route.ts

@@ -20,6 +20,12 @@ export const registerGetRoute = ({
     {
       // this endpoint is used by the data views plugin, see https://github.com/elastic/kibana/issues/152708
       path: addBasePath('/indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/rollup/server/routes/api/indices/register_validate_index_pattern_route.ts

@@ -60,6 +60,12 @@ export const registerValidateIndexPatternRoute = ({
   router.get(
     {
       path: addBasePath('/index_pattern_validity/{indexPattern}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: schema.object({
           indexPattern: schema.string(),

x-pack/platform/plugins/private/rollup/server/routes/api/jobs/register_create_route.ts

@@ -17,6 +17,12 @@ export const registerCreateRoute = ({
   router.put(
     {
       path: addBasePath('/create'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.object({
           job: schema.object(

x-pack/platform/plugins/private/rollup/server/routes/api/jobs/register_delete_route.ts

@@ -17,6 +17,12 @@ export const registerDeleteRoute = ({
   router.post(
     {
       path: addBasePath('/delete'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.object({
           jobIds: schema.arrayOf(schema.string()),

x-pack/platform/plugins/private/rollup/server/routes/api/jobs/register_get_route.ts

@@ -16,6 +16,12 @@ export const registerGetRoute = ({
   router.get(
     {
       path: addBasePath('/jobs'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (context, request, response) => {

x-pack/platform/plugins/private/rollup/server/routes/api/jobs/register_start_route.ts

@@ -17,6 +17,12 @@ export const registerStartRoute = ({
   router.post(
     {
       path: addBasePath('/start'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.object({
           jobIds: schema.arrayOf(schema.string()),

x-pack/platform/plugins/private/rollup/server/routes/api/jobs/register_stop_route.ts

@@ -17,6 +17,12 @@ export const registerStopRoute = ({
   router.post(
     {
       path: addBasePath('/stop'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.object({
           jobIds: schema.arrayOf(schema.string()),

x-pack/platform/plugins/private/rollup/server/routes/api/search/register_search_route.ts

@@ -17,6 +17,12 @@ export const registerSearchRoute = ({
   router.post(
     {
       path: addBasePath('/search'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.arrayOf(
           schema.object({

x-pack/platform/plugins/private/snapshot_restore/server/routes/api/app.ts

@@ -30,7 +30,16 @@ export function registerAppRoutes({
   lib: { handleEsError },
 }: RouteDependencies) {
   router.get(
-    { path: addBasePath('privileges'), validate: false },
+    {
+      path: addBasePath('privileges'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
 

x-pack/platform/plugins/private/snapshot_restore/server/routes/api/policy.ts

@@ -21,7 +21,16 @@ export function registerPolicyRoutes({
 }: RouteDependencies) {
   // GET all policies
   router.get(
-    { path: addBasePath('policies'), validate: false },
+    {
+      path: addBasePath('policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
 
@@ -51,7 +60,16 @@ export function registerPolicyRoutes({
 
   // GET one policy
   router.get(
-    { path: addBasePath('policy/{name}'), validate: { params: nameParameterSchema } },
+    {
+      path: addBasePath('policy/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: nameParameterSchema },
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
       const { name } = req.params as TypeOf<typeof nameParameterSchema>;

x-pack/platform/plugins/private/snapshot_restore/server/routes/api/repositories.ts

@@ -40,7 +40,16 @@ export function registerRepositoriesRoutes({
 }: RouteDependencies) {
   // GET all repositories
   router.get(
-    { path: addBasePath('repositories'), validate: false },
+    {
+      path: addBasePath('repositories'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
       const managedRepositoryName = await getManagedRepositoryName(clusterClient.asCurrentUser);
@@ -99,7 +108,16 @@ export function registerRepositoriesRoutes({
 
   // GET one repository
   router.get(
-    { path: addBasePath('repositories/{name}'), validate: { params: nameParameterSchema } },
+    {
+      path: addBasePath('repositories/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: nameParameterSchema },
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
       const { name } = req.params as TypeOf<typeof nameParameterSchema>;

x-pack/platform/plugins/private/snapshot_restore/server/routes/api/restore.ts

@@ -22,7 +22,16 @@ export function registerRestoreRoutes({
 }: RouteDependencies) {
   // GET all snapshot restores
   router.get(
-    { path: addBasePath('restores'), validate: false },
+    {
+      path: addBasePath('restores'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
 

x-pack/platform/plugins/private/snapshot_restore/server/routes/api/snapshots.ts

@@ -45,7 +45,16 @@ export function registerSnapshotsRoutes({
 }: RouteDependencies) {
   // GET all snapshots
   router.get(
-    { path: addBasePath('snapshots'), validate: { query: snapshotListSchema } },
+    {
+      path: addBasePath('snapshots'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { query: snapshotListSchema },
+    },
     license.guardApiRoute(async (ctx, req, res) => {
       const { client: clusterClient } = (await ctx.core).elasticsearch;
       const sortField =

x-pack/platform/plugins/private/watcher/server/routes/api/indices/register_get_index_patterns_route.ts

@@ -16,6 +16,12 @@ export function registerGetIndexPatternsRoute({
   router.get(
     {
       path: '/api/watcher/indices/index_patterns',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on saved object client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async ({ core }, request, response) => {

x-pack/platform/plugins/private/watcher/server/routes/api/indices/register_get_route.ts

@@ -79,6 +79,12 @@ export function registerGetRoute({ router, license, lib: { handleEsError } }: Ro
   router.post(
     {
       path: '/api/watcher/indices',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/license/register_refresh_route.ts

@@ -17,6 +17,12 @@ export function registerRefreshRoute({ router, license }: RouteDependencies) {
   router.get(
     {
       path: '/api/watcher/license/refresh',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on license for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute((ctx, request, response) => {

x-pack/platform/plugins/private/watcher/server/routes/api/register_list_fields_route.ts

@@ -35,6 +35,12 @@ export function registerListFieldsRoute({
   router.post(
     {
       path: '/api/watcher/fields',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/register_load_history_route.ts

@@ -38,6 +38,12 @@ export function registerLoadHistoryRoute({
   router.get(
     {
       path: '/api/watcher/history/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/settings/register_load_route.ts

@@ -21,6 +21,12 @@ export function registerLoadRoute({ router, license, lib: { handleEsError } }: R
   router.get(
     {
       path: '/api/watcher/settings',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (ctx, request, response) => {

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_activate_route.ts

@@ -33,6 +33,12 @@ export function registerActivateRoute({
   router.put(
     {
       path: '/api/watcher/watch/{watchId}/activate',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_deactivate_route.ts

@@ -32,6 +32,12 @@ export function registerDeactivateRoute({
   router.put(
     {
       path: '/api/watcher/watch/{watchId}/deactivate',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_delete_route.ts

@@ -27,6 +27,12 @@ export function registerDeleteRoute({
   router.delete(
     {
       path: '/api/watcher/watch/{watchId}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_execute_route.ts

@@ -41,6 +41,12 @@ export function registerExecuteRoute({
   router.put(
     {
       path: '/api/watcher/watch/execute',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_history_route.ts

@@ -56,6 +56,12 @@ export function registerHistoryRoute({
   router.get(
     {
       path: '/api/watcher/watch/{watchId}/history',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
         query: querySchema,

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_load_route.ts

@@ -26,6 +26,12 @@ export function registerLoadRoute({ router, license, lib: { handleEsError } }: R
   router.get(
     {
       path: '/api/watcher/watch/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_save_route.ts

@@ -28,6 +28,12 @@ export function registerSaveRoute({ router, license, lib: { handleEsError } }: R
   router.put(
     {
       path: '/api/watcher/watch/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
         body: bodySchema,

x-pack/platform/plugins/private/watcher/server/routes/api/watch/register_visualize_route.ts

@@ -42,6 +42,12 @@ export function registerVisualizeRoute({
   router.post(
     {
       path: '/api/watcher/watch/visualize',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watches/register_delete_route.ts

@@ -51,6 +51,12 @@ export function registerDeleteRoute({ router, license }: RouteDependencies) {
   router.post(
     {
       path: '/api/watcher/watches/delete',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/private/watcher/server/routes/api/watches/register_list_route.ts

@@ -12,6 +12,12 @@ export function registerListRoute({ router, license, lib: { handleEsError } }: R
   router.get(
     {
       path: '/api/watcher/watches',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     license.guardApiRoute(async (ctx, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/component_templates/register_create_route.ts

@@ -19,6 +19,12 @@ export const registerCreateRoute = ({
   router.post(
     {
       path: addBasePath('/component_templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: componentTemplateSchema,
       },

x-pack/platform/plugins/shared/index_management/server/routes/api/component_templates/register_datastream_route.ts

@@ -54,6 +54,12 @@ export const registerGetDatastreams = ({
   router.get(
     {
       path: addBasePath('/component_templates/{name}/datastreams'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },
@@ -85,6 +91,12 @@ export const registerReferencedIndexTemplateMeta = ({
   router.get(
     {
       path: addBasePath('/component_templates/{name}/referenced_index_template_meta'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/shared/index_management/server/routes/api/component_templates/register_delete_route.ts

@@ -21,6 +21,12 @@ export const registerDeleteRoute = ({
   router.delete(
     {
       path: addBasePath('/component_templates/{names}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/shared/index_management/server/routes/api/component_templates/register_get_route.ts

@@ -22,7 +22,16 @@ const paramsSchema = schema.object({
 export function registerGetAllRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   // Get all component templates
   router.get(
-    { path: addBasePath('/component_templates'), validate: false },
+    {
+      path: addBasePath('/component_templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
 
@@ -53,6 +62,12 @@ export function registerGetAllRoute({ router, lib: { handleEsError } }: RouteDep
   router.get(
     {
       path: addBasePath('/component_templates/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: paramsSchema,
       },

x-pack/platform/plugins/shared/index_management/server/routes/api/component_templates/register_update_route.ts

@@ -23,6 +23,12 @@ export const registerUpdateRoute = ({
   router.put(
     {
       path: addBasePath('/component_templates/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: componentTemplateSchema,
         params: paramsSchema,

x-pack/platform/plugins/shared/index_management/server/routes/api/data_streams/register_delete_route.ts

@@ -18,6 +18,12 @@ export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addBasePath('/delete_data_streams'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: bodySchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/data_streams/register_get_route.ts

@@ -138,7 +138,16 @@ export function registerGetAllRoute({ router, lib: { handleEsError }, config }:
     includeStats: schema.maybe(schema.oneOf([schema.literal('true'), schema.literal('false')])),
   });
   router.get(
-    { path: addBasePath('/data_streams'), validate: { query: querySchema } },
+    {
+      path: addBasePath('/data_streams'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { query: querySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
 
@@ -197,6 +206,12 @@ export function registerGetOneRoute({ router, lib: { handleEsError }, config }:
   router.get(
     {
       path: addBasePath('/data_streams/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/data_streams/register_post_route.ts

@@ -29,6 +29,12 @@ export function registerPostOneApplyLatestMappings({
   router.post(
     {
       path: addBasePath('/data_streams/{name}/mappings_from_template'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema },
     },
     async (context, request, response) => {
@@ -79,6 +85,12 @@ export function registerPostOneRollover({
   router.post(
     {
       path: addBasePath('/data_streams/{name}/rollover'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/data_streams/register_put_route.ts

@@ -29,6 +29,12 @@ export function registerPutDataRetention({ router, lib: { handleEsError } }: Rou
   router.put(
     {
       path: addBasePath('/data_streams/data_retention'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: bodySchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/enrich_policies/register_create_route.ts

@@ -52,6 +52,12 @@ export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addInternalBasePath('/enrich_policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: validationSchema, query: querySchema },
     },
     async (context, request, response) => {
@@ -87,6 +93,12 @@ export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addInternalBasePath('/enrich_policies/get_matching_indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: getMatchingIndicesSchema },
     },
     async (context, request, response) => {
@@ -114,6 +126,12 @@ export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addInternalBasePath('/enrich_policies/get_matching_data_streams'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: getMatchingIndicesSchema },
     },
     async (context, request, response) => {
@@ -142,6 +160,12 @@ export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addInternalBasePath('/enrich_policies/get_fields_from_indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: getFieldsFromIndicesSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/enrich_policies/register_delete_route.ts

@@ -20,6 +20,12 @@ export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDep
   router.delete(
     {
       path: addInternalBasePath('/enrich_policies/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/enrich_policies/register_execute_route.ts

@@ -20,6 +20,12 @@ export function registerExecuteRoute({ router, lib: { handleEsError } }: RouteDe
   router.put(
     {
       path: addInternalBasePath('/enrich_policies/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/enrich_policies/register_list_route.ts

@@ -12,7 +12,16 @@ import { enrichPoliciesActions } from '../../../lib/enrich_policies';
 
 export function registerListRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addInternalBasePath('/enrich_policies'), validate: false },
+    {
+      path: addInternalBasePath('/enrich_policies'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     async (context, request, response) => {
       const client = (await context.core).elasticsearch.client as IScopedClusterClient;
       try {

x-pack/platform/plugins/shared/index_management/server/routes/api/enrich_policies/register_privileges_route.ts

@@ -25,6 +25,12 @@ export const registerPrivilegesRoute = ({
   router.get(
     {
       path: addInternalBasePath('/enrich_policies/privileges'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: false,
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_clear_cache_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerClearCacheRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/clear_cache'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/clear_cache'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_close_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerCloseRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/close'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/close'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_create_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.put(
-    { path: addInternalBasePath('/indices/create'), validate: { body: bodySchema } },
+    {
+      path: addInternalBasePath('/indices/create'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indexName } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_delete_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/delete'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/delete'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_flush_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerFlushRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/flush'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/flush'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_forcemerge_route.ts

@@ -20,6 +20,12 @@ export function registerForcemergeRoute({ router, lib: { handleEsError } }: Rout
   router.post(
     {
       path: addBasePath('/indices/forcemerge'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_get_route.ts

@@ -21,6 +21,12 @@ export function registerGetRoute({
   router.get(
     {
       path: addInternalBasePath('/indices/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         params: schema.object({
           indexName: schema.string(),

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_list_route.ts

@@ -16,7 +16,16 @@ export function registerListRoute({
   config,
 }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/indices'), validate: false },
+    {
+      path: addBasePath('/indices'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       try {

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_open_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerOpenRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/open'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/open'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_refresh_route.ts

@@ -17,7 +17,16 @@ const bodySchema = schema.object({
 
 export function registerRefreshRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/refresh'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/refresh'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_reload_route.ts

@@ -26,7 +26,16 @@ export function registerReloadRoute({
   config,
 }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/reload'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/reload'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indexNames = [] } = (request.body as typeof bodySchema.type) ?? {};

x-pack/platform/plugins/shared/index_management/server/routes/api/indices/register_unfreeze_route.ts

@@ -16,7 +16,16 @@ const bodySchema = schema.object({
 
 export function registerUnfreezeRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/indices/unfreeze'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/indices/unfreeze'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indices = [] } = request.body as typeof bodySchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/inference_models/register_get_route.ts

@@ -14,6 +14,12 @@ export function registerGetAllRoute({ router, lib: { handleEsError } }: RouteDep
   router.get(
     {
       path: addBasePath('/inference/all'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {},
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/mapping/register_mapping_route.ts

@@ -23,7 +23,16 @@ function formatHit(hit: { [key: string]: { mappings: any } }, indexName: string)
 
 export function registerGetMappingRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/mapping/{indexName}'), validate: { params: paramsSchema } },
+    {
+      path: addBasePath('/mapping/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: paramsSchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indexName } = request.params as typeof paramsSchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/mapping/register_update_mapping_route.ts

@@ -18,6 +18,12 @@ export function registerUpdateMappingRoute({ router, lib: { handleEsError } }: R
   router.put(
     {
       path: addBasePath('/mapping/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.maybe(schema.object({}, { unknowns: 'allow' })),
         params: paramsSchema,

x-pack/platform/plugins/shared/index_management/server/routes/api/nodes/register_nodes_route.ts

@@ -11,7 +11,16 @@ import { addBasePath } from '..';
 export function registerNodesRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   // Retrieve the es plugins installed on the cluster nodes
   router.get(
-    { path: addBasePath('/nodes/plugins'), validate: {} },
+    {
+      path: addBasePath('/nodes/plugins'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: {},
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
 

x-pack/platform/plugins/shared/index_management/server/routes/api/settings/register_load_route.ts

@@ -23,7 +23,16 @@ function formatHit(hit: { [key: string]: {} }) {
 
 export function registerLoadRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/settings/{indexName}'), validate: { params: paramsSchema } },
+    {
+      path: addBasePath('/settings/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: paramsSchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indexName } = request.params as typeof paramsSchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/settings/register_update_route.ts

@@ -20,6 +20,12 @@ export function registerUpdateRoute({ router, lib: { handleEsError } }: RouteDep
   router.put(
     {
       path: addBasePath('/settings/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: bodySchema, params: paramsSchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/stats/register_stats_route.ts

@@ -31,7 +31,16 @@ function formatHit(hit: Hit, indexName: string) {
 
 export function registerStatsRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/stats/{indexName}'), validate: { params: paramsSchema } },
+    {
+      path: addBasePath('/stats/{indexName}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { params: paramsSchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const { indexName } = request.params as typeof paramsSchema.type;

x-pack/platform/plugins/shared/index_management/server/routes/api/templates/register_create_route.ts

@@ -17,7 +17,16 @@ const bodySchema = templateSchema;
 
 export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDependencies) {
   router.post(
-    { path: addBasePath('/index_templates'), validate: { body: bodySchema } },
+    {
+      path: addBasePath('/index_templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: { body: bodySchema },
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
       const template = request.body as TemplateDeserialized;

x-pack/platform/plugins/shared/index_management/server/routes/api/templates/register_delete_route.ts

@@ -25,6 +25,12 @@ export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDep
   router.post(
     {
       path: addBasePath('/delete_index_templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { body: bodySchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/templates/register_get_routes.ts

@@ -19,7 +19,16 @@ import { addBasePath } from '..';
 
 export function registerGetAllRoute({ router, config, lib: { handleEsError } }: RouteDependencies) {
   router.get(
-    { path: addBasePath('/index_templates'), validate: false },
+    {
+      path: addBasePath('/index_templates'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
+      validate: false,
+    },
     async (context, request, response) => {
       const { client } = (await context.core).elasticsearch;
 
@@ -70,6 +79,12 @@ export function registerGetOneRoute({ router, config, lib: { handleEsError } }:
   router.get(
     {
       path: addBasePath('/index_templates/{name}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: { params: paramsSchema, query: querySchema },
     },
     async (context, request, response) => {

x-pack/platform/plugins/shared/index_management/server/routes/api/templates/register_simulate_route.ts

@@ -16,6 +16,12 @@ export function registerSimulateRoute({ router, lib: { handleEsError } }: RouteD
   router.post(
     {
       path: addBasePath('/index_templates/simulate/{templateName?}'),
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Relies on es client for authorization',
+        },
+      },
       validate: {
         body: schema.nullable(bodySchema),
         params: schema.object({ templateName: schema.maybe(schema.string()) }),