Dynatrace SaaS API token scopes may exceed intended integration permissions

Dynatrace SaaS exposes a default public API endpoint that requires token-based authentication. The goal is to confirm whether an API token can be limited to the minimum actions needed for a specific integration without inheriting broader permissions from the associated user role.

RBAC roles define permissible actions, but it is unclear whether token scopes are evaluated independently of role entitlements at request time. Network zones that restrict inbound traffic apply to Dynatrace Managed, not SaaS, so SaaS customers have fewer network-level controls for the public endpoint.

• Are Dynatrace SaaS API token scopes enforced independently of the token owner's RBAC role?
• Can SaaS API tokens be bound to specific IP ranges or caller origins?
• Is there a pre-production validation method for effective token permissions?