Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

From the CLI: ; Run the command pureapiclient list to display all configured API clients. ; Review the output to verify the Access Policy, Enabled status, and token TTL for each client. ; Verify no API clients are enabled that are no longer actively in use.

修复方式

修复方法: 操作指南或基础设施补丁

To align with the security recommendations, delete or disable inactive API clients, and ensure all active clients are bound to restrictive access policies with short-lived tokens. (Note: Modifying or deleting an active API client will immediately invalidate its issued tokens, so changes should be coordinated with the teams responsible for those integrations). From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the API Clients panel, select any unused clients and click the trash icon to delete them. ; For active clients, click the edit icon to reduce the assigned access policy or shorten the token TTL as appropriate.