Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Does a Fleet user API token ever get rotated by Fleet itself?

IIRC the token will expire if unused for some time.

<https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#session_duration>

Looking at that doc it seems it doesn't matter whether it is active or not.

We are trying to find a way to programmatically add a Fleet user - Was going to try and use the first user's API token. So the default value of `session_duration` means that the API token will be regenerated every 90 days, correct?

Yes, and I believe in order for it to be regenerated they will need to re-authenticate.