Dormant credentials disable themselves

The first of the month, 06:00. A cron entry in the IT container runs a script: GET /api/v1/auth/tokens, and for every token whose last_used_at is older than ninety days, PUT /api/v1/auth/tokens/{id} with is_enabled: false. The secret still exists; it just stops working. A notification lands on the IT display: fourteen tokens disabled, aliases listed, last IP for each.

Someone shouts on Tuesday. Their token was the one for the quarterly export they forgot about. Re-enabling is the same PUT with true, and now last_used_at is fresh for another ninety days.

Quarterly access reviews are usually a spreadsheet and a meeting: who still needs this, does anyone know what it's for. Here the token carries its own evidence: last use, last address: and a schedule reads it.

The access review is a cron job that reads last_used_at.