Elasticsearch API key expiration enforcement with allow_expired enabled

Goal: Determine whether an expired Elasticsearch API key remains usable when allow_expired is enabled, and whether cluster-wide security settings or role assignments change that outcome.

Elasticsearch can issue API keys with an explicit expiration timestamp and provides an allow_expired option for legacy integrations. The exact enforcement moment and its interaction with other authentication controls are not fully documented, and behavior may vary across major releases.

• Does allow_expired permit authentication with an expired key regardless of the key’s assigned role privileges?
• Is expiration checked at request time, at token issuance, or at both points?
• Do cluster-wide security settings override or modify allow_expired evaluation?