List the access inventory (one row per grant)

• limit integer
  Page size. minimum 1, maximum 100, default 25
• offset integer
  Rows to skip (offset mode). Cannot be combined with cursor. minimum 0, maximum 10000, default 0
• cursor string
  An opaque cursor taken from meta.nextCursor of the previous page (cursor mode). Valid for 24 hours and bound to the token and the query; do not parse or construct it.
• sort[accessId] string
  Sort direction for accessId.
  "asc" | "desc"
• sort[updatedAt] string
  Sort direction for updatedAt.
  "asc" | "desc"
• filter[accessId][eq] string
  Filter accessId (eq).
• filter[accessId][in] string
  Filter accessId (in). Comma-separated, at most 50 values.
• filter[assetId][eq] string
  Filter assetId (eq).
• filter[assetId][in] string
  Filter assetId (in). Comma-separated, at most 50 values.
• filter[employeeId][eq] string
  Filter employeeId (eq).
• filter[employeeId][in] string
  Filter employeeId (in). Comma-separated, at most 50 values.
• filter[identityType][eq] string
  Filter identityType (eq).
• filter[identityType][in] string
  Filter identityType (in). Comma-separated, at most 50 values.
• filter[isDormant][eq] boolean
  Filter isDormant (eq).
• filter[isPrivileged][eq] boolean
  Filter isPrivileged (eq).
• filter[roleLevel][eq] string
  Filter roleLevel (eq).
• filter[roleLevel][in] string
  Filter roleLevel (in). Comma-separated, at most 50 values.
• filter[status][eq] string
  Filter status (eq).
• filter[status][in] string
  Filter status (in). Comma-separated, at most 50 values.
• filter[updatedAt][gte] string (date-time)
  Filter updatedAt (gte).
• filter[updatedAt][lt] string (date-time)
  Filter updatedAt (lt).

An array of object:

• accessId string required
  Grant id (acc_ FlakeID); the keyset tie-break.
• accountState string required
  Account state reported by the source system: ACTIVE, SUSPENDED, BLOCKED, INVITED or UNKNOWN (default; never guessed).
• assetCriticality string required
  Asset criticality (LOW, MEDIUM, HIGH, CRITICAL).
• assetId string required
  Asset id, always ast_ (a legacy row's 24-hex id is returned as ast_<hex>); empty when the stored value is not an id.
• assetLegacyId string
  The legacy 24-hex asset id; present only for legacy rows.
• assetName string required
  Asset name as entered in AutoCISO (organisation data).
• dormantDays integer required
  Whole days since the last activity, computed at read time.
• employeeId string required
  Holder of the grant (empl_ FlakeID); empty for an unmatched account. Resolve names with employee_resolve.
• firstObservedAt string (date-time) or null required
  First time AutoCISO observed the grant (not the grant date in the source system).
• identityType string required
  HUMAN or SERVICE_ACCOUNT.
• isDormant boolean required
  No activity for 30 days, computed at read time from the dates (it changes without a write, so updatedAt does not move).
• isPrivileged boolean required
  true when roleLevel is ADMIN.
• lastDetectedAt string (date-time) required
  Last time an audit detected the grant.
• lastUsedAt string (date-time) or null required
  Last observed use, when known.
• lastVerifiedAt string (date-time) or null required
  Last verification, when known.
• revocationSource string required
  Who revoked the grant: MANUAL, SNAPSHOT_REVIEW or MATCH_CORRECTED; empty for an active grant.
• revokedAt string (date-time) or null required
  When the grant was revoked; null for an active grant.
• riskFactors array of string required
  Risk factor codes (closed set: for example TERMINATED_EMPLOYEE_ACCESS, DORMANT_ACCESS, STALE_PRIVILEGE, UNMAPPED_ACCOUNT, ADMIN_LEVEL_ACCESS, CRITICAL_CRITICALITY_ASSET, OWNER_NOT_ASSIGNED). Unknown factors are omitted.
• riskScore integer required
  Risk score (0..100).
• roleConfidence number required
  Confidence of the role classification (0..1).
• roleLevel string required
  ADMIN, MANAGER or VIEWER.
• status string required
  Lifecycle status (ACTIVE, REVOKED).
• updatedAt string (date-time) or null required
  Last write to the grant (incremental-sync field); null until the row is backfilled.
• No other fields.