STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

API refresh tokens must be configured to expire.

DISA Rule

SV-274681r1143714_rule

Vulnerability Number

V-274681

Group Title

SRG-APP-000400

Rule Version

SRG-APP-000400-API-000865

Severity

CAT II

CCI(s)

• CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

10

Fix Recommendation

Build or configure API refresh tokens to expire according to organizational defined parameters.

Check Contents

Verify API refresh tokens are configured to expire according to organizational defined parameters.

If API refresh tokens are not configured to expire according to organizational defined parameters, this is a finding.

Vulnerability Number

V-274681

Documentable

False

Rule Version

SRG-APP-000400-API-000865

Severity Override Guidance

Verify API refresh tokens are configured to expire according to organizational defined parameters.

If API refresh tokens are not configured to expire according to organizational defined parameters, this is a finding.

Check Content Reference

M

Target Key

5703