Access reviews API
Periodic reviews of who can do what, signed off by a person.
Objects
An access review covers every user, role and grant and how each was used in the last 90 days, with recommendations (grant, revoke, adjust) and a drafted text (by the AI when it is on).
Life cycle
POST /access-reviews (a draft) → read recommendations → POST /access-reviews/{id}/sign-off with the indexes to apply and a note. The sign-off is a person's act (user_token_required for client credentials); the chosen changes are applied and logged.
Endpoints
| Call | What it does | Scope |
|---|---|---|
GET/access-reviews | Access reviews | access_reviews:read |
GET/access-reviews/{id} | One access review with its recommendations | access_reviews:read |
POST/access-reviews | Draft a new access review | access_reviews:write |
POST/access-reviews/{id}/sign-off | Sign off, applying the chosen recommendations (a person) | access_reviews:write |