anchor.diff:  `name`::
   (Required, string) Specifies the name for this API key.
   
  +[[api-key-role-descriptors]]
   `role_descriptors`::
   (Optional, array-of-role-descriptor) An array of role descriptors for this API
   key. This parameter is optional. When it is not specified or is an empty array,
  
positive.code:     }
    }
  }
  ------------------------------------------------------------
  <1> optional expiration for the API key being generated. If expiration is not
   provided then the API keys do not expire.
  <2> optional role descriptors for this API key, if not provided then permissions
   of authenticated user are applied.
  
  A successful call returns a JSON structure that provides
  API key information.
  
  [source,console-result]
  --------------------------------------------------
  {
    "id":"VuaCfGcBCdbkQm-e5aOx", <1>
    "name":"my-api-key",
    "expiration":1544068612110, <2>
    "api_key":"ui2lp2axTNmsyakw9tvNnw" <3>
  }
  --------------------------------------------------
  // TESTRESPONSE[s/VuaCfGcBCdbkQm-e5aOx/$body.id/]
  // TESTRESPONSE[s/1544068612110/$body.expiration/]
  // TESTRESPONSE[s/ui2lp2axTNmsyakw9tvNnw/$body.api_key/]
  <1> unique id for this API key
  <2> optional expiration in milliseconds for this API key
  <3> generated API key
  
  The API key returned by this API can then be used by sending a request with an
  `Authorization` header with a value having the prefix `ApiKey` followed
  by the _credentials_, where _credentials_ are the base64 encoding of `id` and `api_key` joined by a colon.
  
  NOTE: If your node has `xpack.security.http.ssl.enabled` set to `true`, then you must specify `https` when creating your API key.
  
  [source,shell]
  --------------------------------------------------
  curl -H "Authorization: ApiKey VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==" http://localhost:9200/_cluster/health
  --------------------------------------------------
  // NOTCONSOLE
  
  One way to create the credentials from CLI on an Unix-like system is as the follows:
  
  [source,shell]
  ----
  # Please note the use of "-n" to instruct echo to not print the trailing newline character.
  # It should return VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==
  echo -n "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw" | base64
  ----
  
negative.code: 
  IMPORTANT: If the credential that is used to authenticate this request is
  an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.
  See the note under <<api-key-role-descriptors,`role_descriptors`>>.
  
  [[security-api-create-api-key-desc]]
  ==== {api-description-title}
  
  The API keys are created by the {es} API key service, which is automatically enabled
  when you <<encrypt-http-communication,configure TLS on the HTTP interface>>. Alternatively,
  you can explicitly enable the `xpack.security.authc.api_key.enabled` setting. When
  you are running in production mode, a bootstrap check prevents you from enabling
  the API key service unless you also enable TLS on the HTTP interface.
  
  A successful request returns a JSON structure that contains the
  API key, its unique id, and its name. If applicable, it also returns expiration
  information for the API key in milliseconds.
  
  