anchor.diff:  
   IMPORTANT: If the credential that is used to authenticate this request is
   an API key, the derived API key cannot have any privileges. If you specify privileges, the API returns an error.
  -See the note under `role_descriptors`.
  +See the note under <<api-key-role-descriptors,`role_descriptors`>>.
   
   [[security-api-create-api-key-desc]]
   ==== {api-description-title}
   
   The API keys are created by the {es} API key service, which is automatically enabled
  -when you configure TLS on the HTTP interface. See <<encrypt-http-communication>>. Alternatively,
  +when you <<encrypt-http-communication,configure TLS on the HTTP interface>>. Alternatively,
   you can explicitly enable the `xpack.security.authc.api_key.enabled` setting. When
   you are running in production mode, a bootstrap check prevents you from enabling
   the API key service unless you also enable TLS on the HTTP interface.
   
  -A successful create API key API call returns a JSON structure that contains the
  +A successful request returns a JSON structure that contains the
   API key, its unique id, and its name. If applicable, it also returns expiration
   information for the API key in milliseconds.
   
  
positive.code:     }
    }
  }
  ------------------------------------------------------------
  <1> optional expiration for the API key being generated. If expiration is not
   provided then the API keys do not expire.
  <2> optional role descriptors for this API key, if not provided then permissions
   of authenticated user are applied.
  
  A successful call returns a JSON structure that provides
  API key information.
  
  [source,console-result]
  --------------------------------------------------
  {
    "id":"VuaCfGcBCdbkQm-e5aOx", <1>
    "name":"my-api-key",
    "expiration":1544068612110, <2>
    "api_key":"ui2lp2axTNmsyakw9tvNnw" <3>
  }
  --------------------------------------------------
  // TESTRESPONSE[s/VuaCfGcBCdbkQm-e5aOx/$body.id/]
  // TESTRESPONSE[s/1544068612110/$body.expiration/]
  // TESTRESPONSE[s/ui2lp2axTNmsyakw9tvNnw/$body.api_key/]
  <1> unique id for this API key
  <2> optional expiration in milliseconds for this API key
  <3> generated API key
  
  The API key returned by this API can then be used by sending a request with an
  `Authorization` header with a value having the prefix `ApiKey` followed
  by the _credentials_, where _credentials_ are the base64 encoding of `id` and `api_key` joined by a colon.
  
  NOTE: If your node has `xpack.security.http.ssl.enabled` set to `true`, then you must specify `https` when creating your API key.
  
  [source,shell]
  --------------------------------------------------
  curl -H "Authorization: ApiKey VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==" http://localhost:9200/_cluster/health
  --------------------------------------------------
  // NOTCONSOLE
  
  One way to create the credentials from CLI on an Unix-like system is as the follows:
  
  [source,shell]
  ----
  # Please note the use of "-n" to instruct echo to not print the trailing newline character.
  # It should return VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw==
  echo -n "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw" | base64
  ----
  
negative.code: `name`::
  (Required, string) Specifies the name for this API key.
  
  [[api-key-role-descriptors]]
  `role_descriptors`::
  (Optional, array-of-role-descriptor) An array of role descriptors for this API
  key. This parameter is optional. When it is not specified or is an empty array,
  