anchor.diff:  --------------------------------------------------
   // CONSOLE
   
  -.Token Request Fields
  -[cols="4,^2,10"]
  -|=======================
  -| Name        | Required  | Description
  -| `username`  | yes       | The username that identifies the user.
  -| `password`  | yes       | The user's password.
  -| `grant_type`| yes       | The type of grant. Currently only the `password`
  -                            grant type is supported.
  -| `scope`     | no        | The scope of the token. Currently tokens are only
  -                            issued for a scope of `FULL` regardless of the value
  -                            sent with the request.
  -|=======================
  -
  -A successful call returns a JSON structure that contains the access token, the
  -amount of time (seconds) that the token expires in, the type, and the scope if
  -available.
  +The following example output contains the access token, the amount of time (in
  +seconds) that the token expires in, and the type:
   
   [source,js]
   --------------------------------------------------
  
positive.code: === Token Management APIs
  
  The `token` API enables you to create and invalidate bearer tokens for access
  without requiring basic authentication. The get token API takes the same
  parameters as a typical OAuth 2.0 token API except for the use of a JSON
  request body.
  
  [[security-api-get-token]]
  To obtain a token, submit a POST request to the `/_xpack/security/oauth2/token`
  endpoint.
  
negative.code: --------------------------------------------------
  // TESTRESPONSE[s/dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==/$body.access_token/]
  
  The token returned by this API can be used by sending a request with a
  `Authorization` header with a value having the prefix `Bearer ` followed
  by the value of the `access_token`.
  