New Relic User API Key Revocation and Active Session Termination Delay

Goal: Determine whether revoking a New Relic user API key or tightening its RBAC role immediately invalidates all active API sessions, or whether existing bearer tokens remain valid until they naturally expire.

Assumption: This concerns the current user API key and NerdGraph authentication model, not legacy ingest keys. New Relic documentation describes key revocation as an administrative action, but the research brief flags an unresolved propagation delay between permission revocation and session termination.

Uncertainty: If a service account continues calling NerdGraph after its key is deleted or its role is downgraded, the window of continued access affects least-privilege enforcement and incident response timing.

Questions:

• Does New Relic invalidate active NerdGraph access tokens immediately upon user API key revocation?
• Is there a documented cache or propagation delay before RBAC role changes take effect for authenticated requests?
• How can administrators verify that a revoked key no longer authorizes API calls without waiting for token expiry?