diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_internal_user_factory.ts b/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_internal_user_factory.ts
deleted file mode 100644
index 20d6fe2b593e3f..00000000000000
--- a/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_internal_user_factory.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { once } from 'lodash';
-import { ServerShim } from '../types';
-
-const _callWithInternalUser = once((server: any) => {
-  const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
-  return callWithInternalUser;
-});
-
-export const callWithInternalUserFactory = (server: ServerShim) => {
-  return (...args: any[]) => {
-    return _callWithInternalUser(server)(...args);
-  };
-};
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts b/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
index 5d4b7030375e64..659e5b5fdbeb5b 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
@@ -4,19 +4,23 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ElasticsearchServiceSetup } from 'src/core/server';
 import { once } from 'lodash';
 import { elasticsearchJsPlugin } from './elasticsearch_js_plugin';
 import { ServerShim } from '../types';
 
-const callWithRequest = once((server: any) => {
+const callWithRequest = once((elasticsearchService: ElasticsearchServiceSetup) => {
   const config = { plugins: [elasticsearchJsPlugin] };
-  const cluster = server.plugins.elasticsearch.createCluster('watcher', config);
-
-  return cluster.callWithRequest;
+  return elasticsearchService.createClient('watcher', config);
 });
 
-export const callWithRequestFactory = (server: ServerShim, request: any) => {
+export const callWithRequestFactory = (
+  elasticsearchService: ElasticsearchServiceSetup,
+  request: any
+) => {
   return (...args: any[]) => {
-    return callWithRequest(server)(request, ...args);
+    return callWithRequest(elasticsearchService)
+      .asScoped(request)
+      .callAsCurrentUser(...args);
   };
 };
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts b/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
index 1a0d4bbac9ff85..2e8c81efa19c01 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
@@ -3,6 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { first } from 'rxjs/operators';
 import { Plugin, CoreSetup } from 'src/core/server';
 import { i18n } from '@kbn/i18n';
 import { PLUGIN } from '../../common/constants';
@@ -18,9 +19,15 @@ import { registerListFieldsRoute } from './routes/api/register_list_fields_route
 import { registerLoadHistoryRoute } from './routes/api/register_load_history_route';
 
 export class WatcherServerPlugin implements Plugin<void, void, any, any> {
-  async setup({ http }: CoreSetup, { __LEGACY: serverShim }: { __LEGACY: ServerShim }) {
+  async setup(
+    { http, elasticsearch: elasticsearchService }: CoreSetup,
+    { __LEGACY: serverShim }: { __LEGACY: ServerShim }
+  ) {
+    const elasticsearch = await elasticsearchService.adminClient$.pipe(first()).toPromise();
     const router = http.createRouter();
     const routeDependencies: RouteDependencies = {
+      elasticsearch,
+      elasticsearchService,
       router,
     };
     // Register license checker
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
index d98dd06189e9b3..31bc4c785e3003 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
@@ -63,7 +63,7 @@ function getIndices(callWithRequest: any, pattern: string, limit = 10) {
 export function registerGetRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const { pattern } = request.body;
 
     try {
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
index 5b09585feee0ad..3ec218f25ffa6b 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
@@ -28,7 +28,7 @@ export function registerListFieldsRoute(deps: RouteDependencies, legacy: ServerS
   const isEsError = isEsErrorFactory(legacy);
 
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const { indexes } = request.body;
 
     try {
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
index b7780ab7e078ba..869293334478e0 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
@@ -31,7 +31,7 @@ function fetchHistoryItem(callWithRequest: any, watchHistoryItemId: string) {
 export function registerLoadHistoryRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const id = request.params.id;
 
     try {
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
index d9aa3621451f21..5c8818b43f9a47 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
@@ -4,16 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RequestHandler } from 'src/core/server';
-import { callWithInternalUserFactory } from '../../../lib/call_with_internal_user_factory';
+import { IClusterClient, RequestHandler } from 'src/core/server';
 import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 // @ts-ignore
 import { Settings } from '../../../models/settings';
 import { RouteDependencies, ServerShim } from '../../../types';
 
-function fetchClusterSettings(callWithInternalUser: any) {
-  return callWithInternalUser('cluster.getSettings', {
+function fetchClusterSettings(client: IClusterClient) {
+  return client.callAsInternalUser('cluster.getSettings', {
     includeDefaults: true,
     filterPath: '**.xpack.notification',
   });
@@ -23,7 +22,7 @@ export function registerLoadRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
     try {
-      const settings = await fetchClusterSettings(callWithInternalUser);
+      const settings = await fetchClusterSettings(deps.elasticsearch);
       return response.ok({ body: Settings.fromUpstreamJson(settings).downstreamJson });
     } catch (e) {
       // Case: Error from Elasticsearch JS client
@@ -35,8 +34,6 @@ export function registerLoadRoute(deps: RouteDependencies, legacy: ServerShim) {
       return response.internalError({ body: e });
     }
   };
-  const callWithInternalUser = callWithInternalUserFactory(legacy);
-
   deps.router.get(
     {
       path: '/api/watcher/settings',
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
index 7dd55d20126030..0be94dda47cb30 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
@@ -24,7 +24,7 @@ function acknowledgeAction(callWithRequest: any, watchId: string, actionId: stri
 export function registerAcknowledgeRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const { watchId, actionId } = request.params;
 
     try {
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
index 9e7cc78a4ab225..3f7d132b7d352d 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
@@ -23,7 +23,7 @@ function activateWatch(callWithRequest: any, watchId: string) {
 export function registerActivateRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     const { watchId } = request.params;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
index 6283d596d9bcb1..9108190489fe5a 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
@@ -22,7 +22,7 @@ function deactivateWatch(callWithRequest: any, watchId: string) {
 export function registerDeactivateRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     const { watchId } = request.params;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
index df2ced5931d51d..5e974d48dff0ef 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
@@ -20,7 +20,7 @@ function deleteWatch(callWithRequest: any, watchId: string) {
 export function registerDeleteRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     const { watchId } = request.params;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
index 5e2912db81c6d3..06da7ad8341d3d 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
@@ -31,7 +31,7 @@ function executeWatch(callWithRequest: any, executeDetails: any, watchJson: any)
 export function registerExecuteRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const executeDetails = ExecuteDetails.fromDownstreamJson(request.body.executeDetails);
     const watch = Watch.fromDownstreamJson(request.body.watch);
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
index f18a3fedcca6e0..49d83485c9ec92 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
@@ -45,7 +45,7 @@ function fetchHistoryItems(callWithRequest: any, watchId: any, startTime: any) {
 export function registerHistoryRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const { watchId } = request.params;
     const { startTime } = request.query;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
index 3480f961f16838..17f59300da73fa 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
@@ -23,7 +23,7 @@ function fetchWatch(callWithRequest: any, watchId: string) {
 export function registerLoadRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     const id = request.params.id;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
index d9a5ad844d7d8e..f16bd233040bd3 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
@@ -33,7 +33,7 @@ function saveWatch(callWithRequest: any, id: string, body: any) {
 export function registerSaveRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const { id } = request.params;
     const { type, isNew, ...watchConfig } = request.body;
 
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
index b86dfcd1ea9a2b..d7f4158a4eebcf 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
@@ -31,7 +31,7 @@ function fetchVisualizeData(callWithRequest: any, index: any, body: any) {
 export function registerVisualizeRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
     const watch = Watch.fromDownstreamJson(request.body.watch);
     const options = VisualizeOptions.fromDownstreamJson(request.body.options);
     const body = watch.getVisualizeQuery(options);
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
index c3b5f2b0e7334e..29c539a0de138a 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
@@ -39,7 +39,7 @@ function deleteWatches(callWithRequest: any, watchIds: string[]) {
 
 export function registerDeleteRoute(deps: RouteDependencies, legacy: ServerShim) {
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     try {
       const results = await deleteWatches(callWithRequest, request.body.watchIds);
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
index 8112603130ef40..db90b3f5b26fff 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
@@ -33,7 +33,7 @@ function fetchWatches(callWithRequest: any) {
 export function registerListRoute(deps: RouteDependencies, legacy: ServerShim) {
   const isEsError = isEsErrorFactory(legacy);
   const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
-    const callWithRequest = callWithRequestFactory(legacy, request);
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
 
     try {
       const hits = await fetchWatches(callWithRequest);
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/types.ts b/x-pack/legacy/plugins/watcher/server/np_ready/types.ts
index d2d5d814d311c1..1b566332befdf8 100644
--- a/x-pack/legacy/plugins/watcher/server/np_ready/types.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/types.ts
@@ -4,19 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IRouter } from 'src/core/server';
+import { IRouter, ElasticsearchServiceSetup, IClusterClient } from 'src/core/server';
 import { XPackMainPlugin } from '../../../xpack_main/xpack_main';
-import { ElasticsearchPlugin } from '../../../../../../src/legacy/core_plugins/elasticsearch';
 
 export interface ServerShim {
   route: any;
   plugins: {
     xpack_main: XPackMainPlugin;
     watcher: any;
-    elasticsearch: ElasticsearchPlugin;
   };
 }
 
 export interface RouteDependencies {
   router: IRouter;
+  elasticsearchService: ElasticsearchServiceSetup;
+  elasticsearch: IClusterClient;
 }