diff --git a/packages/kbn-test/src/functional_tests/lib/auth.js b/packages/kbn-test/src/functional_tests/lib/auth.js
index 522dcee9d3b0b..751e7444756f9 100644
--- a/packages/kbn-test/src/functional_tests/lib/auth.js
+++ b/packages/kbn-test/src/functional_tests/lib/auth.js
@@ -34,7 +34,7 @@ async function updateCredentials(port, auth, username, password, retries = 10) {
           auth,
           hostname: 'localhost',
           port,
-          pathname: `/_xpack/security/user/${username}/_password`,
+          pathname: `/_security/user/${username}/_password`,
         }),
         json: true,
         body: { password },
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
index 231eeebef08a7..609fc9d46394a 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
@@ -40,7 +40,7 @@ async function verifyHasPrivileges(req) {
 
   const response = await callWithRequest(req, 'transport.request', {
     method: 'POST',
-    path: '/_xpack/security/user/_has_privileges',
+    path: '/_security/user/_has_privileges',
     body: {
       index: [
         {
diff --git a/x-pack/server/lib/esjs_shield_plugin.js b/x-pack/server/lib/esjs_shield_plugin.js
index e8b962e89e7b8..22c2c757db4c3 100644
--- a/x-pack/server/lib/esjs_shield_plugin.js
+++ b/x-pack/server/lib/esjs_shield_plugin.js
@@ -27,7 +27,7 @@
     shield.authenticate = ca({
       params: {},
       url: {
-        fmt: '/_xpack/security/_authenticate'
+        fmt: '/_security/_authenticate'
       }
     });
 
@@ -46,7 +46,7 @@
       },
       urls: [
         {
-          fmt: '/_xpack/security/user/<%=username%>/_password',
+          fmt: '/_security/user/<%=username%>/_password',
           req: {
             username: {
               type: 'string',
@@ -55,7 +55,7 @@
           }
         },
         {
-          fmt: '/_xpack/security/user/_password'
+          fmt: '/_security/user/_password'
         }
       ],
       needBody: true,
@@ -77,7 +77,7 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/realm/<%=realms%>/_clear_cache',
+        fmt: '/_security/realm/<%=realms%>/_clear_cache',
         req: {
           realms: {
             type: 'string',
@@ -97,7 +97,7 @@
     shield.clearCachedRoles = ca({
       params: {},
       url: {
-        fmt: '/_xpack/security/role/<%=name%>/_clear_cache',
+        fmt: '/_security/role/<%=name%>/_clear_cache',
         req: {
           name: {
             type: 'string',
@@ -122,7 +122,7 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/role/<%=name%>',
+        fmt: '/_security/role/<%=name%>',
         req: {
           name: {
             type: 'string',
@@ -147,7 +147,7 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/user/<%=username%>',
+        fmt: '/_security/user/<%=username%>',
         req: {
           username: {
             type: 'string',
@@ -168,7 +168,7 @@
       params: {},
       urls: [
         {
-          fmt: '/_xpack/security/role/<%=name%>',
+          fmt: '/_security/role/<%=name%>',
           req: {
             name: {
               type: 'string',
@@ -177,7 +177,7 @@
           }
         },
         {
-          fmt: '/_xpack/security/role'
+          fmt: '/_security/role'
         }
       ]
     });
@@ -192,7 +192,7 @@
       params: {},
       urls: [
         {
-          fmt: '/_xpack/security/user/<%=username%>',
+          fmt: '/_security/user/<%=username%>',
           req: {
             username: {
               type: 'list',
@@ -201,7 +201,7 @@
           }
         },
         {
-          fmt: '/_xpack/security/user'
+          fmt: '/_security/user'
         }
       ]
     });
@@ -220,7 +220,7 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/role/<%=name%>',
+        fmt: '/_security/role/<%=name%>',
         req: {
           name: {
             type: 'string',
@@ -246,7 +246,7 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/user/<%=username%>',
+        fmt: '/_security/user/<%=username%>',
         req: {
           username: {
             type: 'string',
@@ -266,7 +266,7 @@
       params: {},
       urls: [
         {
-          fmt: '/_xpack/security/user/_privileges'
+          fmt: '/_security/user/_privileges'
         }
       ]
     });
@@ -288,7 +288,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/saml/prepare'
+        fmt: '/_security/saml/prepare'
       }
     });
 
@@ -307,7 +307,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/saml/authenticate'
+        fmt: '/_security/saml/authenticate'
       }
     });
 
@@ -322,7 +322,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/saml/logout'
+        fmt: '/_security/saml/logout'
       }
     });
 
@@ -337,7 +337,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/saml/logout'
+        fmt: '/_security/saml/logout'
       }
     });
 
@@ -355,7 +355,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/saml/invalidate'
+        fmt: '/_security/saml/invalidate'
       }
     });
 
@@ -371,7 +371,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/oauth2/token'
+        fmt: '/_security/oauth2/token'
       }
     });
 
@@ -391,14 +391,14 @@
         }
       },
       url: {
-        fmt: '/_xpack/security/oauth2/token'
+        fmt: '/_security/oauth2/token'
       }
     });
 
     shield.getPrivilege = ca({
       method: 'GET',
       urls: [{
-        fmt: '/_xpack/security/privilege/<%=privilege%>',
+        fmt: '/_security/privilege/<%=privilege%>',
         req: {
           privilege: {
             type: 'string',
@@ -406,14 +406,14 @@
           }
         }
       }, {
-        fmt: '/_xpack/security/privilege'
+        fmt: '/_security/privilege'
       }]
     });
 
     shield.deletePrivilege = ca({
       method: 'DELETE',
       urls: [{
-        fmt: '/_xpack/security/privilege/<%=application%>/<%=privilege%>',
+        fmt: '/_security/privilege/<%=application%>/<%=privilege%>',
         req: {
           application: {
             type: 'string',
@@ -431,7 +431,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/privilege'
+        fmt: '/_security/privilege'
       }
     });
 
@@ -439,7 +439,7 @@
       method: 'POST',
       needBody: true,
       url: {
-        fmt: '/_xpack/security/user/_has_privileges'
+        fmt: '/_security/user/_has_privileges'
       }
     });
   };
diff --git a/x-pack/test/api_integration/apis/es/has_privileges.js b/x-pack/test/api_integration/apis/es/has_privileges.js
index 1e30eb774cc02..21283d483ca37 100644
--- a/x-pack/test/api_integration/apis/es/has_privileges.js
+++ b/x-pack/test/api_integration/apis/es/has_privileges.js
@@ -53,7 +53,7 @@ export default function ({ getService }) {
     function createHasPrivilegesRequest(privileges) {
       const supertest = getService('esSupertestWithoutAuth');
       return supertest
-        .post(`/_xpack/security/user/_has_privileges`)
+        .post(`/_security/user/_has_privileges`)
         .auth('testuser', 'testpassword')
         .send({
           applications: [{