diff --git a/rest-api-spec/src/main/resources/rest-api-spec/api/security.get_api_key.json b/rest-api-spec/src/main/resources/rest-api-spec/api/security.get_api_key.json
index bf782e96a0499..452ad7cef607c 100644
--- a/rest-api-spec/src/main/resources/rest-api-spec/api/security.get_api_key.json
+++ b/rest-api-spec/src/main/resources/rest-api-spec/api/security.get_api_key.json
@@ -45,6 +45,11 @@
         "type":"boolean",
         "default":false,
         "description": "flag to show the limited-by role descriptors of API Keys"
+      },
+      "active_only":{
+        "type":"boolean",
+        "default":false,
+        "description": "flag to limit response to only active (not invalidated or expired) API keys"
       }
     }
   }
diff --git a/x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/api_key/10_basic.yml b/x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/api_key/10_basic.yml
index b575ddccb449a..09f08d59049ec 100644
--- a/x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/api_key/10_basic.yml
+++ b/x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/api_key/10_basic.yml
@@ -191,6 +191,7 @@ teardown:
         Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_user
       security.get_api_key:
         owner: true
+        active_only: true
   - length: { "api_keys" : 1 }
   - match: { "api_keys.0.username": "api_key_user" }
   - match: { "api_keys.0.invalidated": false }