[Synthetics] Migrate obs security api_keys FTR test to Scout API

Ports `x-pack/solutions/observability/test/api_integration/apis/security`
(API key creation with synthetics-service ES privileges + uptime feature)
to a Scout API spec in the synthetics suite, and removes the standalone FTR
config along with its Buildkite manifest and CODEOWNERS entries.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: shahzad31

.buildkite/ftr-manifests/ftr_oblt_stateful_configs.yml

@@ -35,7 +35,6 @@ enabled:
   - x-pack/solutions/observability/test/functional/apps/apm/config.ts
   - x-pack/solutions/observability/test/functional_with_es_ssl/config.ts
   - x-pack/solutions/observability/test/api_integration/apis/cases/config.ts
-  - x-pack/solutions/observability/test/api_integration/apis/security/config.ts
   - x-pack/solutions/observability/test/accessibility/config.ts
   - x-pack/solutions/observability/test/functional/apps/infra/config.ts
   - x-pack/solutions/observability/test/functional/config.firefox.ts

.github/CODEOWNERS

@@ -1919,7 +1919,6 @@ x-pack/platform/plugins/shared/streams/common/sig_events_tuning_config.ts @elast
 /x-pack/solutions/observability/test/accessibility/apps/observability.ts @elastic/actionable-obs-team
 /x-pack/solutions/observability/test/functional/services/slo/ @elastic/actionable-obs-team
 /x-pack/solutions/observability/test/observability_functional @elastic/actionable-obs-team
-/x-pack/solutions/observability/test/api_integration/apis/security/ @elastic/actionable-obs-team
 /x-pack/solutions/observability/plugins/infra/public/alerting @elastic/actionable-obs-team
 /x-pack/solutions/observability/plugins/infra/server/lib/alerting @elastic/actionable-obs-team
 /x-pack/solutions/observability/test/api_integration_deployment_agnostic/apis/alerting/ @elastic/actionable-obs-team

x-pack/solutions/observability/plugins/synthetics/test/scout/.meta/api/standard.json

@@ -1,6 +1,19 @@
 {
-  "sha1": "38069c93eb2ea0f612e27c7486f67a9c6eb65af1",
+  "sha1": "2c9bd37f28a7c69ee2f5e6eb8f85da935f64e8cf",
   "tests": [
+    {
+      "id": "8ac308de9d7a2bf-019801460b8f6ef",
+      "title": "ApiKeys [POST] internal/security/api_key allows an API key to be created with kibana privileges",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/solutions/observability/plugins/synthetics/test/scout/api/tests/api_keys.spec.ts",
+        "line": 50,
+        "column": 10
+      }
+    },
     {
       "id": "1592a89c4ddba37-f51682f5b9fe1da",
       "title": "getMonitorFilters get list of filters (empty)",

x-pack/solutions/observability/plugins/synthetics/test/scout/api/tests/api_keys.spec.ts

@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { expect } from '@kbn/scout-oblt/api';
+import { apiTest, KIBANA_HEADERS } from '../fixtures';
+
+/**
+ * Ported from FTR
+ * `x-pack/solutions/observability/test/api_integration/apis/security/api_keys.ts`.
+ *
+ * Verifies a privileged user can create an API key whose role descriptors carry
+ * the synthetics-service Elasticsearch privileges plus the uptime feature. Drives
+ * the *internal* security route, so it uses cookie-based auth
+ * (`samlAuth.asInteractiveUser('admin')` + `KIBANA_HEADERS`), matching the
+ * `synthetics_enablement` spec.
+ *
+ * The Elasticsearch privileges mirror `getServiceApiKeyPrivileges(false)` from
+ * `@kbn/synthetics-plugin/server/synthetics_service/get_api_key`; we inline them
+ * here (and use `'*'` for `ALL_SPACES_ID`) to avoid importing across the plugin
+ * server boundary, matching the local-constants convention in this Scout suite.
+ *
+ * Tagged stateful-only to preserve the original FTR scope: the legacy `uptime`
+ * feature privilege and the stateful-only `read_ilm` cluster privilege are not
+ * meaningful in the serverless observability target.
+ */
+
+const SYNTHETICS_SERVICE_ES_PRIVILEGES = {
+  cluster: ['monitor', 'read_pipeline', 'read_ilm'],
+  indices: [
+    {
+      names: ['synthetics-*'],
+      privileges: ['view_index_metadata', 'create_doc', 'auto_configure', 'read'],
+    },
+  ],
+  run_as: [],
+} as const;
+
+apiTest.describe('ApiKeys', { tag: ['@local-stateful-classic'] }, () => {
+  let adminHeaders: Record<string, string>;
+
+  apiTest.beforeAll(async ({ samlAuth }) => {
+    const { cookieHeader } = await samlAuth.asInteractiveUser('admin');
+    adminHeaders = { ...KIBANA_HEADERS, ...cookieHeader };
+  });
+
+  apiTest(
+    '[POST] internal/security/api_key allows an API key to be created with kibana privileges',
+    async ({ apiClient }) => {
+      const res = await apiClient.post('internal/security/api_key', {
+        headers: adminHeaders,
+        body: {
+          name: 'test_api_key',
+          expiration: '12d',
+          kibana_role_descriptors: {
+            uptime_save: {
+              elasticsearch: SYNTHETICS_SERVICE_ES_PRIVILEGES,
+              kibana: [
+                {
+                  base: [],
+                  spaces: ['*'],
+                  feature: {
+                    uptime: ['all'],
+                  },
+                },
+              ],
+            },
+          },
+        },
+        responseType: 'json',
+      });
+
+      expect(res).toHaveStatusCode(200);
+      expect(res.body).toMatchObject({ name: 'test_api_key' });
+    }
+  );
+});