---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_privileges:
      body: "{\n  \"apm\": {\n    \"read\": {\n      \"application\": \"apm\",\n \
        \     \"name\": \"read\",\n      \"actions\": [ \"data:read/*\" ]\n    },\n\
        \    \"write\": {\n      \"application\": \"apm\",\n      \"name\": \"write\"\
        ,\n      \"actions\": [ \"data:write/*\" ]\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_privileges:
      application: "apm"
      name: "read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test create api key:
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-1\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ]\n    },\n    \"role-b\": {\n      \"cluster\"\
        : [\"manage\"],\n      \"index\": [\n        {\n          \"names\": [\"index-b\"\
        ],\n          \"privileges\": [\"all\"]\n        }\n      ]\n    }\n  }\n\
        }\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-1"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
    encoded: "credentials"
- do:
    security.authenticate: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    username: "owner_name"
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "${owner_name}"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "api-key-1"
- do:
    security.clear_api_key_cache:
      ids: "${api_key_id}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test get api key (with role descriptors + metadata):
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-2\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ]\n    }\n  },\n  \"metadata\": {\n    \"string\"\
        : \"bean\",\n    \"number\": 5,\n    \"boolean\": true\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-2"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
    name: "api_key_name"
    encoded: "credentials"
- do:
    security.authenticate: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    username: "owner_name"
- do:
    security.get_api_key:
      id: "$api_key_id"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "$api_key_name"
- match:
    api_keys.0.username: "$owner_name"
- match:
    api_keys.0.invalidated: false
- is_true: "api_keys.0.creation"
- match:
    api_keys.0.metadata.string: "bean"
- match:
    api_keys.0.metadata.number: 5
- match:
    api_keys.0.metadata.boolean: true
- match:
    api_keys.0.role_descriptors:
      role-a:
        cluster:
        - "all"
        indices:
        - names:
          - "index-a"
          privileges:
          - "read"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- do:
    security.get_api_key:
      owner: true
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.username: "$owner_name"
- match:
    api_keys.0.name: "$api_key_name"
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.invalidated: false
- is_true: "api_keys.0.creation"
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "$api_key_name"
- match:
    api_keys.0.username: "$owner_name"
---
Test invalidate api keys:
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-delete-1\",\n  \"expiration\": \"1d\",\n  \"\
        role_descriptors\": { }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-delete-1"
- set:
    id: "api_key_id_1"
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-delete-2\",\n  \"expiration\": \"1d\",\n  \"\
        role_descriptors\": { }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-delete-2"
- set:
    id: "api_key_id_2"
- do:
    security.invalidate_api_key:
      body: "{\n  \"ids\": [ \"${api_key_id_1}\", \"${api_key_id_2}\" ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    invalidated_api_keys: 2
- match:
    invalidated_api_keys.0: "/^(${api_key_id_1}|${api_key_id_2})$/"
- match:
    invalidated_api_keys.1: "/^(${api_key_id_1}|${api_key_id_2})$/"
- length:
    previously_invalidated_api_keys: 0
- match:
    error_count: 0
---
Test has privileges API for api key:
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ],\n      \"applications\": [\n        {\n\
        \          \"application\": \"apm\",\n          \"privileges\": [\"read\"\
        ],\n          \"resources\": [\"*\"]\n        }\n      ]\n    },\n    \"role-b\"\
        : {\n      \"cluster\": [\"manage\"],\n      \"index\": [\n        {\n   \
        \       \"names\": [\"index-b\"],\n          \"privileges\": [\"all\"]\n \
        \       }\n      ]\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    id: "api_key_id"
    encoded: "credentials"
- do:
    security.authenticate: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    username: "owner_name"
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"index\": [\n    {\n      \"names\" :[ \"*\", \"index-a\" ],\n\
        \      \"privileges\" : [ \"read\", \"index\", \"write\" ]\n    },\n    {\n\
        \      \"names\" :[ \"index-a\", \"index-b\" ],\n      \"privileges\" : [\
        \ \"read\", \"write\" ]\n    }\n  ],\n  \"application\": [\n    {\n      \"\
        application\" : \"apm\",\n      \"resources\" : [ \"*\", \"some-other-res\"\
        \ ],\n      \"privileges\" : [ \"data:read/me\", \"data:write/me\" ]\n   \
        \ }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "$owner_name"
- match:
    has_all_requested: false
- match:
    index:
      '*':
        read: false
        index: false
        write: false
      index-a:
        read: true
        index: false
        write: false
      index-b:
        read: true
        write: true
- match:
    application:
      apm:
        '*':
          data:read/me: true
          data:write/me: false
        some-other-res:
          data:read/me: true
          data:write/me: false
---
Test update api keys:
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-update\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"access\": { \"cluster\": [\"monitor\"] }\n  },\n  \"metadata\"\
        : {\n    \"step\": 1\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-update"
- set:
    id: "api_key_id"
    encoded: "credentials"
- do:
    security.authenticate: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    username: "owner_name"
- do:
    security.get_api_key:
      id: "$api_key_id"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "api-key-update"
- match:
    api_keys.0.username: "$owner_name"
- match:
    api_keys.0.metadata.step: 1
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage\"]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: false
- do:
    security.update_api_key:
      id: "$api_key_id"
      body: "{\n  \"role_descriptors\": {\n    \"access\": { \"cluster\": [\"manage\"\
        ] }\n  },\n  \"metadata\": {\n    \"step\": 2\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: true
- do:
    security.get_api_key:
      id: "$api_key_id"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "api-key-update"
- match:
    api_keys.0.username: "$owner_name"
- match:
    api_keys.0.metadata.step: 2
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage\"]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
---
Test query api keys:
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"query-key-1\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {},\n  \"metadata\": {\n    \"search\": \"this\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "query-key-1"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_1"
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"query-key-2\",\n  \"expiration\": \"2d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": { \"cluster\": [ \"monitor\"] }\n  },\n  \"metadata\"\
        : {\n    \"search\": false\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "query-key-2"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_2"
- do:
    security.create_api_key:
      body: "{\n  \"name\": \"query-key-3\",\n  \"expiration\": \"3d\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "query-key-3"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_3"
- do:
    security.authenticate: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- set:
    username: "owner_name"
- do:
    security.query_api_keys:
      body: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 3
- match:
    count: 3
- do:
    security.query_api_keys:
      body: "{\n  \"query\": { \"wildcard\": {\"name\": \"*-2\"} }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 1
- match:
    count: 1
- match:
    api_keys.0.id: "${api_key_id_2}"
- do:
    security.query_api_keys:
      body: "{\n  \"query\": { \"bool\": {\n    \"must\": [\n      { \"wildcard\"\
        : {\"name\": \"*key*\"} },\n      { \"term\": {\"username\": \"$owner_name\"\
        } }\n    ]\n  }},\n  \"sort\": [ {\"name\": {\"order\": \"desc\"}} ],\n  \"\
        size\": 2\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 3
- match:
    count: 2
- match:
    api_keys.0.id: "$api_key_id_3"
- match:
    api_keys.1.id: "$api_key_id_2"
- do:
    security.query_api_keys:
      body: "{\n  \"query\": { \"term\": {\"metadata.search\": \"this\"} }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 1
- match:
    count: 1
- match:
    api_keys.0.id: "${api_key_id_1}"
