API Token Management

[shodanwashere]

We're deploying an instance of DefectDojo in our corporate environment and it has come to our attention that, with an Azure AD connection, even if users are removed from the application, any API tokens they made are still valid (it's been 24 hours since we tested with removing a user and their API token is still valid).
In the DefectDojo settings.dist.py file, there also doesn't seem to be any kind of modifiable configuration to change API Token TTL, and it's not specified in the documentation either. Did I miss it anywhere? Is there a way of specifying API Token TTLs?

[kiblik]

Hi @shodanwashere, are you talking about API Token to be able to access DefectDojo API or tokens used in API Scan Configuration?