ARTIFACTORY: How to Identify the Last Usage Time of Access Tokens

In certain cases, it can be useful to know when a specific access token was last used — for example, to monitor activity, identify inactive tokens, or troubleshoot authentication issues.From Artifactory version 7.108.3 and above, the last_used field was introduced to get this information. By default, the last_used field may not be included in the token information returned by the Artifactory. However, this behavior can be enabled by adjusting the configuration file responsible for token tracking.
This article explains how to enable and view the lastUsed field for tokens, allowing you to retrieve the last usage timestamp when querying token information via the Get Token by ID REST API.

For the lastUsed field to be return, follow the steps below:

1. In your Artifactory server, navigate to the directory '$JFROG_HOME/artifactory/var/etc/access'.
    
2. Create a backup of the 'access.config.latest.yml' file, for example:

   cp access.config.latest.yml access.config.backup.yml

3. Edit the 'access.config.latest.yml' file by adding the following content at the very bottom of the file:

   token: 
     last-used-enabled: true
     last-used-threshold: 900

   
   The last-used-threshold parameter is optional and represents the minimum time difference (in seconds) from the previous lastUsed timestamp after which the lastUsed value will be updated. It is used to limit the number of updates. In the example above, the value is set to 900, but you may choose any value you prefer.
4. Save the file and rename it to 'access.config.import.yml'.
5. Restart Artifactory.
   You can now then test it by executing the Get Token By ID REST API:

   curl -H "Authorization: Bearer <ACCESS_TOKEN>" https://<JFROG_URL>/access/api/v1/tokens/<TOKEN_ID>

    

Note that <ACCESS_TOKEN> is the token used to authenticate with Artifactory, and <TOKEN_ID> is the ID of the token whose information you wish to retrieve. This REST API returns details about the specified token ID, including the last_used timestamp. For example:

 

Note: 
After enabling the feature, the last_used field information for a token will not appear immediately. The token must be used at least once after the feature is activated for the field to be included in the response.


For more information and the limitations regarding this parameter, please refer to the following documentation.