STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

API access tokens must be configured to expire.

DISA Rule

SV-274680r1143713_rule

Vulnerability Number

V-274680

Group Title

SRG-APP-000400

Rule Version

SRG-APP-000400-API-000860

Severity

CAT II

CCI(s)

• CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

10

Fix Recommendation

Build or configure API access tokens to expire according to organizational defined parameters.

Check Contents

Verify API access tokens are configured to expire according to organizational defined parameters.

If API access tokens are not configured to expire according to organizational defined parameters, this is a finding.

Vulnerability Number

V-274680

Documentable

False

Rule Version

SRG-APP-000400-API-000860

Severity Override Guidance

Verify API access tokens are configured to expire according to organizational defined parameters.

If API access tokens are not configured to expire according to organizational defined parameters, this is a finding.

Check Content Reference

M

Target Key

5703