anchor.diff:  
   The `user` API enables you to create, read, update, and delete users from the
   `native` realm. These users are commonly referred to as *native users*.
  +
  +
  +==== Request
  +
  +`GET /_xpack/security/user` +
  +
  +`GET /_xpack/security/user/<username>` +
  +
  +`DELETE /_xpack/security/user/<username>` +
  +
  +`POST /_xpack/security/user/<username>` +
  +
  +`PUT /_xpack/security/user/<username>` +
  +
  +`PUT /_xpack/security/user/<username>/_disable` +
  +
  +`PUT /_xpack/security/user/<username>/_enable` +
  +
  +`PUT /_xpack/security/user/<username>/_password`
  +
  +
  +==== Description
  +
  +You can use the PUT user API to create or update users. When updating a user,
  +you can update everything but its `username` and `password`. To change a user's
  +password, use the  <<security-api-reset-user-password, reset password API>>.
  +
  +[[username-validation]]
  +NOTE: Usernames must be at least 1 and no more than 1024 characters. They can
  +contain alphanumeric characters (`a-z`, `A-Z`, `0-9`), spaces, punctuation, and
  +printable symbols in the https://en.wikipedia.org/wiki/Basic_Latin_(Unicode_block)[Basic Latin (ASCII) block].
  +Leading or trailing whitespace is not allowed.
  +
  +==== Path Parameters
  +
  +`username`::
  +  (string) An identifier for the user. If you omit this parameter from a Get
  +  User API request, it retrieves information about all users.
  +
  +
  +==== Request Body
  +
  +The following parameters can be specified in the body of a POST or PUT request
  +and pertain to creating a user:
  +
  +`email`::
  +(string) The email of the user.
  +
  +`full_name`::
  +(string) The full name of the user.
  +
  +`metadata`::
  +(object) Arbitrary metadata that you want to associate with the user.
  +
  +`password` (required)::
  +(string) The user's password. Passwords must be at least 6 characters long.
  +
  +`roles` (required)::
  +(list) A set of roles the user has. The roles determine the user's access
  +permissions.
  +
  +==== Authorization
  +
   To use this API, you must have at least the `manage_security` cluster privilege.
  +
  +
  +==== Examples
   
   [[security-api-put-user]]
   To add a user, submit a PUT or POST request to the `/_xpack/security/user/<username>`
   endpoint.
  -
  -[[username-validation]]
  -NOTE: Usernames must be at least 1 and no more than 1024 characters. They can
  -      contain alphanumeric characters (`a-z`, `A-Z`, `0-9`), spaces,
  -      punctuation, and printable symbols in the https://en.wikipedia.org/wiki/Basic_Latin_(Unicode_block)[Basic Latin (ASCII) block].
  -      Leading or trailing whitespace is not allowed.
   
   [source,js]
   --------------------------------------------------
  
positive.code: // TESTRESPONSE
  <1> When an existing user is updated, `created` is set to false.
  
  NOTE: You also use the PUT user API to update users. When updating a user, you
        can update everything but its `username` and `password`. To change a user's
        password, use the  <<security-api-reset-user-password, reset password API>>.
  
  Once you add a user through the Users API, requests from that user can be
  authenticated.
  
  [source,shell]
  
negative.code: --------------------------------------------------
  // CONSOLE
  
  A successful call returns a JSON structure that shows whether the user has been
  created or updated.
  
  