OpenSearch No permissions for [indices:data/read/msearch] and [indices:data/read/scroll]: add the missing...

OpenSearch clusters using the security plugin (roles defined in roles.yml or Dashboards Security) where an application or user calls the multi-search or scroll APIs and the roles were written granting only the plain search action. Applies to OpenSearch 2.x and 3.x style permission names.

Read the error literally first. The bracketed action in the error is the exact permission that is missing, and the RolesChecked list names the roles the security plugin actually evaluated for that user. Success check: you can name the missing action and the evaluated role for each failing call, instead of guessing at the whole config.

Open the role definition (roles.yml, or Dashboards under Security then Roles) for the evaluated role, for example the Dst-Query role behind the msearch failure and the OSS-DDC role behind the scroll failure. Look at its allowed_actions on the index pattern the call targets (jaeger-span-* in the original msearch case). Success check: the list contains the plain search action and neither of the two failing actions, which confirms the diagnosis before you change anything.

Add the missing action to that same entry, alongside the existing search action: the msearch action for the role serving multi-search calls, and the scroll action for the role serving scroll calls. If one role serves both call types, it needs both actions. Keep the index patterns and cluster permissions exactly as they were. Success check: the role diff is only the added action lines, nothing else moved.

Re-apply the security configuration so the running cluster picks the change up: push the updated config with securityadmin, or save the role edit in Dashboards and confirm it saved. Success check: reading the role back from the cluster (not just the file) shows the new action in allowed_actions.

Re-run the exact call that failed, as the same user. Success check: the msearch or scroll request returns results instead of the no permissions error; if a different action is named in a new error, repeat step 1 for that action rather than broadening the role blindly.

Only if the error names a role you did not expect, check the role mapping next: the user is evaluated through the roles listed in RolesChecked, so confirm in roles_mapping that the user or its backend roles actually map to the role you just edited. Success check: RolesChecked in any remaining error includes the edited role.

In the OpenSearch forum thread 28391 (OP pavani, Nov 4, 2026, 0 replies): multi-search and scroll calls fail with No permissions for the msearch and scroll actions; the error shows RolesChecked naming the Dst-Query role and the OSS-DDC role, and the posted role configs grant only the plain search action on the relevant index patterns. Source: https://forum.opensearch.org/t/no-permissions-for-indices-data-read-msearch-indices-data-read-scroll/28391