How to create API Key for user with `viewer` role?

Elastic Stack Kibana
7

Thank you. THe grant api key rest api worked. So basically I did this:

  1. Login as elastic super user.
  2. Go to Stack Management>Users.
  3. Create the user apmuser with password mypassexample with role viewer.
  4. Go to Dev Tools.
  5. Paste this code to generate api key for the apmuser 
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username": "apmuser",
  "password": "mypassexample",
  "api_key" : {
    "name": "apmuser-key"
  }
}

On separate note, thanks for mentioning the point about Restricted Privileges in my earlier workflow, that it will still use the privileges of the superuser even if i change the role afterwards. Actually, can you point in me in the right direction on understanding the use cases for Roles vs. Roles Descriptors for API Keys? Why are there two paradigms for managing a user's capabilities?