When user A run as user B and creates an API key, the creator realm is recorded as user B's realm. However, when retrieving or invalidating the above API key, user A's realm will be used. This creates a problem for queries with owner=true and leads to empty result set, e.g. GET -H 'es-security-runas-user: B' /_security/api_key?id=keyId&owner=true.

This feels like a bug and it is better to have consistent behaviour for how runas realm is handled for all API key security operations. But it will be a breaking change if users are relying on the current behaviour.