Previously, existing REST access tokens remained valid even after changes were made to the associated user account. 

A user's access tokens are now automatically invalidated for security reasons when:

• the password is changed,
• the user is locked or deactivated,
• the user type, such as administrator status, changes,
• the user's roles or permissions change.

When logging out, the associated refresh tokens are also invalidated.

What does this mean for you?

• Requests with an invalid access token receive the response 401 Unauthorized.
• Integrations and scripts that log in via POST /rest/login must log in again after one of the account changes mentioned above.

• You do not need to configure anything.