The refused requests are the inventory of tokens pointed at the wrong door

Fourteen API tokens across three realms, and something is collecting 403s all week.

GET /users/auth/activity?errors_only=true&min_status=403&max_status=403 lists every authenticated request that was refused: method, path, status code, IP, user-agent, the API token it was made with, the realm. Add realm_id= to narrow it to production. A cron entry pulls the page every Monday and posts the count per token to the ops channel.

The pattern shows up on the second Monday. One token, scoped to staging, presented against production from a CI runner nobody re-pointed after the realm split. Every request refused, so nothing leaked. The log names the token before its owner notices the red builds.

The activity log keeps a year, credentials stripped, no delete endpoint. You can't clear it, and neither can the runner.

The refused requests are the inventory of tokens pointed at the wrong door.