The auditor's API token expires the day the audit ends

The SOC 2 auditor needs read access to the six production containers for three weeks, and to nothing else in the account.

You move the six containers into a dedicated realm. Then POST /api/v1/auth/tokens with permission_template: read_only, realm_ids set to that realm, allow_no_realm: false, the auditor's office IP in ip_whitelist, and expires_at set to the last day of fieldwork. You send the token and the realm-scoped base URL, https://{realmId}.api.hoody.com.

From that host the auditor lists containers and sees six. The base host refuses the token. Any other realm host refuses it too. The token can't create, can't write, and can't be used from the hotel Wi-Fi. On day twenty-two it stops working without anyone remembering to revoke it.

Every request the auditor made sits in your activity log with that token's ID next to it.