Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

From the CLI: ; Run the command pureapiclient list to display all configured API clients. ; Review the output to verify the Access Policy, Enabled status, and token TTL for each client. ; Verify no API clients are enabled that are no longer actively in use.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To align with the security recommendations, delete or disable inactive API clients, and ensure all active clients are bound to restrictive access policies with short-lived tokens. (Note: Modifying or deleting an active API client will immediately invalidate its issued tokens, so changes should be coordinated with the teams responsible for those integrations). From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the API Clients panel, select any unused clients and click the trash icon to delete them. ; For active clients, click the edit icon to reduce the assigned access policy or shorten the token TTL as appropriate.