# List the access inventory (one row per grant)

Requires the `access_review:read` scope.

`GET /access`

Scope `access_review:read`

Requires the `access_review:read` scope.

## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `limit` | integer | no | Page size. minimum 1, maximum 100, default 25 |
| `offset` | integer | no | Rows to skip (offset mode). Cannot be combined with cursor. minimum 0, maximum 10000, default 0 |
| `cursor` | string | no | An opaque cursor taken from meta.nextCursor of the previous page (cursor mode). Valid for 24 hours and bound to the token and the query; do not parse or construct it. |
| `sort[accessId]` | string | no | Sort direction for accessId. One of `asc`, `desc`. |
| `sort[updatedAt]` | string | no | Sort direction for updatedAt. One of `asc`, `desc`. |
| `filter[accessId][eq]` | string | no | Filter accessId (eq). |
| `filter[accessId][in]` | string | no | Filter accessId (in). Comma-separated, at most 50 values. |
| `filter[assetId][eq]` | string | no | Filter assetId (eq). |
| `filter[assetId][in]` | string | no | Filter assetId (in). Comma-separated, at most 50 values. |
| `filter[employeeId][eq]` | string | no | Filter employeeId (eq). |
| `filter[employeeId][in]` | string | no | Filter employeeId (in). Comma-separated, at most 50 values. |
| `filter[identityType][eq]` | string | no | Filter identityType (eq). |
| `filter[identityType][in]` | string | no | Filter identityType (in). Comma-separated, at most 50 values. |
| `filter[isDormant][eq]` | boolean | no | Filter isDormant (eq). |
| `filter[isPrivileged][eq]` | boolean | no | Filter isPrivileged (eq). |
| `filter[roleLevel][eq]` | string | no | Filter roleLevel (eq). |
| `filter[roleLevel][in]` | string | no | Filter roleLevel (in). Comma-separated, at most 50 values. |
| `filter[status][eq]` | string | no | Filter status (eq). |
| `filter[status][in]` | string | no | Filter status (in). Comma-separated, at most 50 values. |
| `filter[updatedAt][gte]` | string (date-time) | no | Filter updatedAt (gte). |
| `filter[updatedAt][lt]` | string (date-time) | no | Filter updatedAt (lt). |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `accessId`: string Grant id (acc_ FlakeID); the keyset tie-break.
- `accountState`: string Account state reported by the source system: ACTIVE, SUSPENDED, BLOCKED, INVITED or UNKNOWN (default; never guessed).
- `assetCriticality`: string Asset criticality (LOW, MEDIUM, HIGH, CRITICAL).
- `assetId`: string Asset id, always ast_ (a legacy row's 24-hex id is returned as ast_<hex>); empty when the stored value is not an id.
- `assetLegacyId`: optional string The legacy 24-hex asset id; present only for legacy rows.
- `assetName`: string Asset name as entered in AutoCISO (organisation data).
- `dormantDays`: integer Whole days since the last activity, computed at read time.
- `employeeId`: string Holder of the grant (empl_ FlakeID); empty for an unmatched account. Resolve names with employee_resolve.
- `firstObservedAt`: string (date-time) or null First time AutoCISO observed the grant (not the grant date in the source system).
- `identityType`: string HUMAN or SERVICE_ACCOUNT.
- `isDormant`: boolean No activity for 30 days, computed at read time from the dates (it changes without a write, so updatedAt does not move).
- `isPrivileged`: boolean true when roleLevel is ADMIN.
- `lastDetectedAt`: string (date-time) Last time an audit detected the grant.
- `lastUsedAt`: string (date-time) or null Last observed use, when known.
- `lastVerifiedAt`: string (date-time) or null Last verification, when known.
- `revocationSource`: string Who revoked the grant: MANUAL, SNAPSHOT_REVIEW or MATCH_CORRECTED; empty for an active grant.
- `revokedAt`: string (date-time) or null When the grant was revoked; null for an active grant.
- `riskFactors`: array of string Risk factor codes (closed set: for example TERMINATED_EMPLOYEE_ACCESS, DORMANT_ACCESS, STALE_PRIVILEGE, UNMAPPED_ACCOUNT, ADMIN_LEVEL_ACCESS, CRITICAL_CRITICALITY_ASSET, OWNER_NOT_ASSIGNED). Unknown factors are omitted.
- `riskScore`: integer Risk score (0..100).
- `roleConfidence`: number Confidence of the role classification (0..1).
- `roleLevel`: string ADMIN, MANAGER or VIEWER.
- `status`: string Lifecycle status (ACTIVE, REVOKED).
- `updatedAt`: string (date-time) or null Last write to the grant (incremental-sync field); null until the row is backfilled.
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | - | no | The request is invalid. |
| 401 | - | no | The token is missing, malformed, expired or revoked. |
| 402 | - | no | The organisation's plan does not include the feature this route needs. |
| 403 | - | no | The token may not use this route. |
| 429 | - | yes | Rate limit or row budget exceeded; retry after the time in Retry-After. |
| 500 | - | no | Unexpected server error. |
| 503 | - | yes | A dependency is temporarily unavailable; retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/access" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/access",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/access", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "accessId": "acc_1hk3p9x2m4qa",
      "accountState": "UNKNOWN",
      "assetCriticality": "HIGH",
      "assetId": "ast_1hfz2k8w0c7d",
      "assetName": "Google Workspace",
      "dormantDays": 1,
      "employeeId": "empl_1hgyun41rx48",
      "firstObservedAt": "2026-03-04T09:12:00Z",
      "identityType": "HUMAN",
      "isDormant": false,
      "isPrivileged": true,
      "lastDetectedAt": "2026-10-12T02:00:00Z",
      "lastUsedAt": "2026-10-11T16:41:00Z",
      "lastVerifiedAt": "2026-09-30T10:05:00Z",
      "revocationSource": "",
      "revokedAt": null,
      "riskFactors": [
        "ADMIN_LEVEL_ACCESS"
      ],
      "riskScore": 42,
      "roleConfidence": 0.97,
      "roleLevel": "ADMIN",
      "status": "ACTIVE",
      "updatedAt": "2026-10-12T02:00:00Z"
    },
    {
      "accessId": "acc_1hk3pa0v7n2e",
      "accountState": "UNKNOWN",
      "assetCriticality": "CRITICAL",
      "assetId": "ast_1hfz2m3r9t5b",
      "assetName": "GitHub",
      "dormantDays": 53,
      "employeeId": "empl_1hgyv08q3k2m",
      "firstObservedAt": "2026-01-15T08:00:00Z",
      "identityType": "HUMAN",
      "isDormant": true,
      "isPrivileged": false,
      "lastDetectedAt": "2026-10-12T02:00:00Z",
      "lastUsedAt": "2026-08-20T11:30:00Z",
      "lastVerifiedAt": null,
      "revocationSource": "",
      "revokedAt": null,
      "riskFactors": [
        "TERMINATED_EMPLOYEE_ACCESS",
        "DORMANT_ACCESS"
      ],
      "riskScore": 68,
      "roleConfidence": 0.88,
      "roleLevel": "VIEWER",
      "status": "ACTIVE",
      "updatedAt": "2026-10-12T02:00:00Z"
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 214
  }
}
```