diff --git a/elasticsearch/_async/client/security.py b/elasticsearch/_async/client/security.py
index 4d26e7899..0a30d376b 100644
--- a/elasticsearch/_async/client/security.py
+++ b/elasticsearch/_async/client/security.py
@@ -2343,12 +2343,22 @@ async def put_user(
         )
 
     @_rewrite_parameters(
-        body_fields=("from_", "query", "search_after", "size", "sort"),
+        body_fields=(
+            "aggregations",
+            "aggs",
+            "from_",
+            "query",
+            "search_after",
+            "size",
+            "sort",
+        ),
         parameter_aliases={"from": "from_"},
     )
     async def query_api_keys(
         self,
         *,
+        aggregations: t.Optional[t.Mapping[str, t.Mapping[str, t.Any]]] = None,
+        aggs: t.Optional[t.Mapping[str, t.Mapping[str, t.Any]]] = None,
         error_trace: t.Optional[bool] = None,
         filter_path: t.Optional[t.Union[str, t.Sequence[str]]] = None,
         from_: t.Optional[int] = None,
@@ -2373,13 +2383,28 @@ async def query_api_keys(
 
         `<https://www.elastic.co/guide/en/elasticsearch/reference/8.13/security-api-query-api-key.html>`_
 
+        :param aggregations: Any aggregations to run over the corpus of returned API
+            keys. Aggregations and queries work together. Aggregations are computed only
+            on the API keys that match the query. This supports only a subset of aggregation
+            types, namely: `terms`, `range`, `date_range`, `missing`, `cardinality`,
+            `value_count`, `composite`, `filter`, and `filters`. Additionally, aggregations
+            only run over the same subset of fields that query works with.
+        :param aggs: Any aggregations to run over the corpus of returned API keys. Aggregations
+            and queries work together. Aggregations are computed only on the API keys
+            that match the query. This supports only a subset of aggregation types, namely:
+            `terms`, `range`, `date_range`, `missing`, `cardinality`, `value_count`,
+            `composite`, `filter`, and `filters`. Additionally, aggregations only run
+            over the same subset of fields that query works with.
         :param from_: Starting document offset. By default, you cannot page through more
             than 10,000 hits using the from and size parameters. To page through more
             hits, use the `search_after` parameter.
-        :param query: A query to filter which API keys to return. The query supports
-            a subset of query types, including `match_all`, `bool`, `term`, `terms`,
-            `ids`, `prefix`, `wildcard`, and `range`. You can query all public information
-            associated with an API key.
+        :param query: A query to filter which API keys to return. If the query parameter
+            is missing, it is equivalent to a `match_all` query. The query supports a
+            subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,
+            `ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.
+            You can query the following public information associated with an API key:
+            `id`, `type`, `name`, `creation`, `expiration`, `invalidated`, `invalidation`,
+            `username`, `realm`, and `metadata`.
         :param search_after: Search after definition
         :param size: The number of hits to return. By default, you cannot page through
             more than 10,000 hits using the `from` and `size` parameters. To page through
@@ -2417,6 +2442,10 @@ async def query_api_keys(
         if with_limited_by is not None:
             __query["with_limited_by"] = with_limited_by
         if not __body:
+            if aggregations is not None:
+                __body["aggregations"] = aggregations
+            if aggs is not None:
+                __body["aggs"] = aggs
             if from_ is not None:
                 __body["from"] = from_
             if query is not None:
diff --git a/elasticsearch/_sync/client/security.py b/elasticsearch/_sync/client/security.py
index 74eedf4c0..958b0fa36 100644
--- a/elasticsearch/_sync/client/security.py
+++ b/elasticsearch/_sync/client/security.py
@@ -2343,12 +2343,22 @@ def put_user(
         )
 
     @_rewrite_parameters(
-        body_fields=("from_", "query", "search_after", "size", "sort"),
+        body_fields=(
+            "aggregations",
+            "aggs",
+            "from_",
+            "query",
+            "search_after",
+            "size",
+            "sort",
+        ),
         parameter_aliases={"from": "from_"},
     )
     def query_api_keys(
         self,
         *,
+        aggregations: t.Optional[t.Mapping[str, t.Mapping[str, t.Any]]] = None,
+        aggs: t.Optional[t.Mapping[str, t.Mapping[str, t.Any]]] = None,
         error_trace: t.Optional[bool] = None,
         filter_path: t.Optional[t.Union[str, t.Sequence[str]]] = None,
         from_: t.Optional[int] = None,
@@ -2373,13 +2383,28 @@ def query_api_keys(
 
         `<https://www.elastic.co/guide/en/elasticsearch/reference/8.13/security-api-query-api-key.html>`_
 
+        :param aggregations: Any aggregations to run over the corpus of returned API
+            keys. Aggregations and queries work together. Aggregations are computed only
+            on the API keys that match the query. This supports only a subset of aggregation
+            types, namely: `terms`, `range`, `date_range`, `missing`, `cardinality`,
+            `value_count`, `composite`, `filter`, and `filters`. Additionally, aggregations
+            only run over the same subset of fields that query works with.
+        :param aggs: Any aggregations to run over the corpus of returned API keys. Aggregations
+            and queries work together. Aggregations are computed only on the API keys
+            that match the query. This supports only a subset of aggregation types, namely:
+            `terms`, `range`, `date_range`, `missing`, `cardinality`, `value_count`,
+            `composite`, `filter`, and `filters`. Additionally, aggregations only run
+            over the same subset of fields that query works with.
         :param from_: Starting document offset. By default, you cannot page through more
             than 10,000 hits using the from and size parameters. To page through more
             hits, use the `search_after` parameter.
-        :param query: A query to filter which API keys to return. The query supports
-            a subset of query types, including `match_all`, `bool`, `term`, `terms`,
-            `ids`, `prefix`, `wildcard`, and `range`. You can query all public information
-            associated with an API key.
+        :param query: A query to filter which API keys to return. If the query parameter
+            is missing, it is equivalent to a `match_all` query. The query supports a
+            subset of query types, including `match_all`, `bool`, `term`, `terms`, `match`,
+            `ids`, `prefix`, `wildcard`, `exists`, `range`, and `simple_query_string`.
+            You can query the following public information associated with an API key:
+            `id`, `type`, `name`, `creation`, `expiration`, `invalidated`, `invalidation`,
+            `username`, `realm`, and `metadata`.
         :param search_after: Search after definition
         :param size: The number of hits to return. By default, you cannot page through
             more than 10,000 hits using the `from` and `size` parameters. To page through
@@ -2417,6 +2442,10 @@ def query_api_keys(
         if with_limited_by is not None:
             __query["with_limited_by"] = with_limited_by
         if not __body:
+            if aggregations is not None:
+                __body["aggregations"] = aggregations
+            if aggs is not None:
+                __body["aggs"] = aggs
             if from_ is not None:
                 __body["from"] = from_
             if query is not None: