I’m guessing that it wrote to your “default” tenant (“namespace”).
Here is a comment related to this:
You can find out which tenants you have access to through _opendistro/_security/api/account?pretty
I’m guessing that -H "securitytenant: global_tenant"\
is wrong and it should be 'global_tenant'
with citation marks.
I have not tested any of this.