A consumer that appeared in the usage log and nowhere else

An API key making four hundred requests a day, belonging to nobody we had a record of.

  key:          ak_live_8c1f4a7e
  created:      2021-08-14
  created by:   a user account deactivated in 2022
  label:        "test"
  requests:     412 a day, every weekday, 09:00-17:00
  endpoints:    one, GET /api/v1/orders

traced by asking the four known integrators whether
any of them recognised the IP range. one did: a
monitoring script written by a contractor.

A key labelled “test” making four hundred production requests a day for five years is what happens when key creation has no required metadata. The label, the owner and an expiry are now mandatory at creation, which is a form with three more fields and would have made this a thirty-second question.