diff --git a/elasticsearch-api/lib/elasticsearch/api/actions/security/query_user.rb b/elasticsearch-api/lib/elasticsearch/api/actions/security/query_user.rb
new file mode 100644
index 0000000000..4dd6e411f6
--- /dev/null
+++ b/elasticsearch-api/lib/elasticsearch/api/actions/security/query_user.rb
@@ -0,0 +1,56 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# Auto generated from build hash f284cc16f4d4b4289bc679aa1529bb504190fe80
+# @see https://github.com/elastic/elasticsearch/tree/main/rest-api-spec
+#
+module Elasticsearch
+  module API
+    module Security
+      module Actions
+        # Retrieves information for Users using a subset of query DSL
+        #
+        # @option arguments [Hash] :headers Custom HTTP headers
+        # @option arguments [Hash] :body From, size, query, sort and search_after
+        #
+        # @see https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-query-user.html
+        #
+        def query_user(arguments = {})
+          request_opts = { endpoint: arguments[:endpoint] || 'security.query_user' }
+
+          arguments = arguments.clone
+          headers = arguments.delete(:headers) || {}
+
+          body   = arguments.delete(:body)
+
+          method = if body
+                     Elasticsearch::API::HTTP_POST
+                   else
+                     Elasticsearch::API::HTTP_GET
+                   end
+
+          path = '_security/_query/user'
+          params = {}
+
+          Elasticsearch::API::Response.new(
+            perform_request(method, path, params, body, headers, request_opts)
+          )
+        end
+      end
+    end
+  end
+end
diff --git a/elasticsearch-api/spec/elasticsearch/api/actions/security/query_user_spec.rb b/elasticsearch-api/spec/elasticsearch/api/actions/security/query_user_spec.rb
new file mode 100644
index 0000000000..d8b6aec98b
--- /dev/null
+++ b/elasticsearch-api/spec/elasticsearch/api/actions/security/query_user_spec.rb
@@ -0,0 +1,49 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'spec_helper'
+
+describe 'client#security#query_user' do
+  let(:expected_args) do
+    [
+      method,
+      '_security/_query/user',
+      {},
+      body,
+      {},
+      { endpoint: 'security.query_user' }
+    ]
+  end
+
+  let(:body) { nil }
+  let(:method) { 'GET' }
+
+  it 'performs the request' do
+    expect(client_double.security.query_user).to be_a Elasticsearch::API::Response
+  end
+
+  context 'when body is specified' do
+    let(:body) do
+      { size: 1, query: 'test' }
+    end
+    let(:method) { 'POST' }
+
+    it 'performs the request' do
+      expect(client_double.security.query_user(body: body)).to be_a Elasticsearch::API::Response
+    end
+  end
+end