diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
index 90b86138a4a6..74f13a05aa7e 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
@@ -12,6 +12,7 @@ import { registerCredentialsRoutes } from './credentials';
 import { registerCurationsRoutes } from './curations';
 import { registerDocumentsRoutes, registerDocumentRoutes } from './documents';
 import { registerEnginesRoutes } from './engines';
+import { registerRoleMappingsRoutes } from './role_mappings';
 import { registerSearchSettingsRoutes } from './search_settings';
 import { registerSettingsRoutes } from './settings';
 
@@ -24,4 +25,5 @@ export const registerAppSearchRoutes = (dependencies: RouteDependencies) => {
   registerDocumentRoutes(dependencies);
   registerCurationsRoutes(dependencies);
   registerSearchSettingsRoutes(dependencies);
+  registerRoleMappingsRoutes(dependencies);
 };
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.test.ts
new file mode 100644
index 000000000000..53368035af22
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.test.ts
@@ -0,0 +1,215 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MockRouter, mockRequestHandler, mockDependencies } from '../../__mocks__';
+
+import {
+  registerRoleMappingsRoute,
+  registerRoleMappingRoute,
+  registerNewRoleMappingRoute,
+  registerResetRoleMappingRoute,
+} from './role_mappings';
+
+const roleMappingBaseSchema = {
+  rules: { username: 'user' },
+  roleType: 'owner',
+  engines: ['e1', 'e2'],
+  accessAllEngines: false,
+  authProvider: ['*'],
+};
+
+describe('role mappings routes', () => {
+  describe('GET /api/app_search/role_mappings', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/app_search/role_mappings',
+      });
+
+      registerRoleMappingsRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings',
+      });
+    });
+  });
+
+  describe('POST /api/app_search/role_mappings', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/app_search/role_mappings',
+      });
+
+      registerRoleMappingsRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings',
+      });
+    });
+
+    describe('validates', () => {
+      it('correctly', () => {
+        const request = { body: roleMappingBaseSchema };
+        mockRouter.shouldValidate(request);
+      });
+
+      it('missing required fields', () => {
+        const request = { body: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
+
+  describe('GET /api/app_search/role_mappings/{id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/app_search/role_mappings/{id}',
+      });
+
+      registerRoleMappingRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings/:id',
+      });
+    });
+  });
+
+  describe('PUT /api/app_search/role_mappings/{id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'put',
+        path: '/api/app_search/role_mappings/{id}',
+      });
+
+      registerRoleMappingRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings/:id',
+      });
+    });
+
+    describe('validates', () => {
+      it('correctly', () => {
+        const request = {
+          body: {
+            ...roleMappingBaseSchema,
+            id: '123',
+          },
+        };
+        mockRouter.shouldValidate(request);
+      });
+
+      it('missing required fields', () => {
+        const request = { body: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
+
+  describe('DELETE /api/app_search/role_mappings/{id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'delete',
+        path: '/api/app_search/role_mappings/{id}',
+      });
+
+      registerRoleMappingRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings/:id',
+      });
+    });
+  });
+
+  describe('GET /api/app_search/role_mappings/new', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/app_search/role_mappings/new',
+      });
+
+      registerNewRoleMappingRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings/new',
+      });
+    });
+  });
+
+  describe('GET /api/app_search/role_mappings/reset', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/app_search/role_mappings/reset',
+      });
+
+      registerResetRoleMappingRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/role_mappings/reset',
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.ts
new file mode 100644
index 000000000000..4b77c8614a52
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/role_mappings.ts
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { RouteDependencies } from '../../plugin';
+
+const roleMappingBaseSchema = {
+  rules: schema.recordOf(schema.string(), schema.string()),
+  roleType: schema.string(),
+  engines: schema.arrayOf(schema.string()),
+  accessAllEngines: schema.boolean(),
+  authProvider: schema.arrayOf(schema.string()),
+};
+
+export function registerRoleMappingsRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/app_search/role_mappings',
+      validate: false,
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings',
+    })
+  );
+
+  router.post(
+    {
+      path: '/api/app_search/role_mappings',
+      validate: {
+        body: schema.object(roleMappingBaseSchema),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings',
+    })
+  );
+}
+
+export function registerRoleMappingRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/app_search/role_mappings/{id}',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings/:id',
+    })
+  );
+
+  router.put(
+    {
+      path: '/api/app_search/role_mappings/{id}',
+      validate: {
+        body: schema.object({
+          ...roleMappingBaseSchema,
+          id: schema.string(),
+        }),
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings/:id',
+    })
+  );
+
+  router.delete(
+    {
+      path: '/api/app_search/role_mappings/{id}',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings/:id',
+    })
+  );
+}
+
+export function registerNewRoleMappingRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/app_search/role_mappings/new',
+      validate: false,
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings/new',
+    })
+  );
+}
+
+export function registerResetRoleMappingRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.post(
+    {
+      path: '/api/app_search/role_mappings/reset',
+      validate: false,
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/role_mappings/reset',
+    })
+  );
+}
+
+export const registerRoleMappingsRoutes = (dependencies: RouteDependencies) => {
+  registerRoleMappingsRoute(dependencies);
+  registerRoleMappingRoute(dependencies);
+  registerNewRoleMappingRoute(dependencies);
+  registerResetRoleMappingRoute(dependencies);
+};