$ curl -k -s -u elastic:changeme https://localhost:9200/_security/role/kibana_system | jq .kibana_system.cluster
[
  "monitor",
  "manage_index_templates",
  "cluster:admin/xpack/monitoring/bulk",
  "manage_saml",
  "manage_token",
  "manage_oidc",
  "cluster:admin/xpack/security/api_key/invalidate",   <---- added
  "grant_api_key",                                     <---- added
  "cluster:admin/xpack/security/privilege/builtin/get",
  "delegate_pki",
  "cluster:admin/ilm/get",
  "cluster:admin/ilm/put",
  "cluster:admin/analyze"
]

 $ curl -k -s -u elastic:changeme  https://localhost:9200/_security/user/kibana | jq -c .kibana.roles
["kibana_system"]

# create key for elastic user
$ curl -k -s -u elastic:changeme -H content-type:application/json -d '{ "name":"my-key" }'  https://localhost:9200/_security/api_key | jq .
{
  "id": "IEFY9HABM4_s1PGvY_DW",
  "name": "my-key",
  "api_key": "2VVEhxpRSwqq3PV3clHGZg"
}
# kibana user invalidates key
$ curl -k -s -u kibana:changeme -H content-type:application/json -XDELETE -d '{ "name":"my-key" }' https://localhost:9200/_security/api_key | jq .
{
  "invalidated_api_keys": [
    "IEFY9HABM4_s1PGvY_DW"
  ],
  "previously_invalidated_api_keys": [],
  "error_count": 0
}

# kibana grants key for elastic user
$ curl -k -s -u kibana:changeme -H content-type:application/json -d '{ "grant_type":"password", "username":"elastic", "password":"changeme" }' https://localhost:9200/_security/api_key/grant | jq .
{
  "id": "HEFi9HABM4_s1PGvv_GA",
  "name": null,
  "api_key": "1XI-g2IWRseli9E3G3yazg"
}

# list keys for elastic user
$ curl -k -s -u elastic:changeme https://localhost:9200/_security/api_key?username=elastic | jq .
{
  "api_keys": [
    {
      "id": "HEFi9HABM4_s1PGvv_GA",
      "name": null,
      "creation": 1584648077171,
      "invalidated": false,
      "username": "elastic",
      "realm": "reserved"
    }
  ]
}