Sulu admin API token authentication scope for non-production testing

Sulu exposes admin API endpoints under /api/admin protected by the Symfony firewall named sulu_api. Authentication for these endpoints is documented via static API tokens created in the Sulu admin UI under Security → API Users, sent as a Bearer token in the Authorization header with stateless firewall handling.

The goal is to validate an integration against the admin API without using production credentials. The relevant uncertainty is how to constrain access for a test API user so it does not grant full admin data access, and how token lifetime is enforced. Token validation relies on the Symfony security component and does not automatically expire unless an explicit expiration date is set on the API user. Behavior of the sulu_api firewall and token header parsing may differ between Sulu 2.x LTS and the latest 2.4 release.

What role and permission configuration limits a test API user to safe read-only access on /api/admin? Is token revocation or expiration enforced by the firewall without an explicit expiration date on the API user? Is Bearer token header parsing consistent across Sulu 2.x LTS and 2.4 for stateless authentication?