SonarQube 9.x: Configuring API Token Expiration for Least-Privilege Users

Goal

We want to enforce least‑privilege access for API tokens in SonarQube 9.x and guarantee that expired tokens are automatically rejected.

Constraints & Uncertainty

SonarQube 9.x exposes the sonar.auth.token.validity property (default 30 days), while 8.x LTS lacks this setting and relies on session‑only authentication. The permission model allows a Browse role, but it is unclear if token‑based requests honor the same role boundaries. Additionally, password resets or account deactivation invalidate all tokens, yet the timing of this invalidation relative to the token‑validity window is not documented.

Unresolved Questions

1. Can we apply a different sonar.auth.token.validity value per user or group, or is it strictly global?
2. Do tokens issued to a user with only the Browse role receive the same 401 response once the validity period expires, or are they exempted?
3. What audit mechanisms exist in SonarQube 9.x to track usage of expired or revoked tokens?