List leaver items across cases (feed)

GET /jml/offboarding/items

Scope jml:read Plan Seed+

Flat feed of reconciled leaver items across cases, for polling. By default items of COMPLETED cases are included alongside OPEN and IN_PROGRESS ones (only CANCELLED cases are excluded unless named in a caseStatus filter), unlike the on-boarding feed, which defaults to OPEN and IN_PROGRESS. Use itemKey as the stable deduplication key. A result set above the server limit returns 422 QUERY_TOO_BROAD. Concurrent feed requests are limited per organisation; excess requests return 429 RATE_LIMITED with Retry-After: 1.

Example

curl "https://api.autociso.io/api/v1/jml/offboarding/items" \
  -H "Authorization: Bearer <your-api-token>"

import requests

response = requests.get(
    "https://api.autociso.io/api/v1/jml/offboarding/items",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/jml/offboarding/items", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());

Response 200

{
  "data": [
    {
      "itemId": "ltsk_example000001",
      "itemKey": "lfc_example000001:ast_example000001",
      "taskId": "ltsk_example000001",
      "caseId": "lfc_example000001",
      "employeeId": "empl_example000001",
      "assetId": "ast_example000001",
      "assetName": "Example CRM",
      "status": "DISCREPANCY",
      "taskStatus": "COMPLETED",
      "accessStatus": "ACTIVE",
      "source": "TASK",
      "openedAt": "2026-09-15T08:00:00Z",
      "taskCompletedAt": "2026-09-16T10:30:00Z",
      "accessLastDetectedAt": "2026-09-29T02:00:00Z"
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 1,
    "summary": {
      "total": 1,
      "revoked": 0,
      "outstanding": 0,
      "discrepancy": 1,
      "attested": 0
    },
    "accessDataAsOf": "2026-09-29T02:00:00Z"
  }
}

Query parameters

limit integer
Page size. Default 25, maximum 100; a larger value is rejected with 400 VALIDATION_FAILED. minimum 1, maximum 100, default 25
offset integer
Zero-based offset. Maximum 100000. minimum 0, maximum 100000, default 0
sort[openedAt] string
"asc" | "desc"
sort[assetName] string
"asc" | "desc"
filter[status][eq] string
Reconciled item status.
"REVOKED" | "OUTSTANDING" | "DISCREPANCY" | "ATTESTED"
filter[status][ne] string
"REVOKED" | "OUTSTANDING" | "DISCREPANCY" | "ATTESTED"
filter[status][in] array of string
maxItems 100
"REVOKED" | "OUTSTANDING" | "DISCREPANCY" | "ATTESTED"
filter[caseStatus][eq] string
Status of the owning case. CANCELLED cases are excluded unless named.
"OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
filter[caseStatus][ne] string
"OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
filter[caseStatus][in] array of string
maxItems 100
"OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
filter[employeeId][eq] string
pattern ^empl_[A-Za-z0-9_-]{1,59}$
filter[employeeId][in] array of string
maxItems 100
filter[assetId][eq] string
pattern ^(ast_[A-Za-z0-9_-]{1,59}|[0-9a-f]{24})$
filter[assetId][in] array of string
maxItems 100
filter[caseId][eq] string
pattern ^lfc_[A-Za-z0-9_-]{1,59}$
filter[openedAt][gte] string (date-time)
Opening time of the owning case.
filter[openedAt][lte] string (date-time)
filter[taskCompletedAt][gte] string (date-time)
filter[taskCompletedAt][lte] string (date-time)

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

itemId string required
itemKey string required
Stable key for deduplicating items across polls: caseId:assetId for an item tied to an application, caseId:taskId for a manual step. It does not change if the asset is later deleted.
taskId string or null required
Null for ACCESS_ONLY items.
caseId string required
employeeId string required
assetId string or null required
Null for MANUAL_TASK items. Older assets may carry a 24-character hex asset id.
assetName string or null required
Null when the asset no longer exists or the item is manual.
status string required
Reconciled each time you read it, from the task status and the access inventory. REVOKED: the inventory shows the access is gone (a stale pending task can still be present; taskStatus tells you); nothing to do. OUTSTANDING: the access is still active and nobody has marked it done, or it is a manual step that is not done; also used for access detected after the case was opened. Remove the access, then wait for the next access scan. DISCREPANCY: someone marked the task done but the access is still detected (a failed removal, a re-provisioned account or stale data). Check it first. ATTESTED: a person marked the item done in the console and the access is not detected; neither verified nor contradicted.
"REVOKED" | "OUTSTANDING" | "DISCREPANCY" | "ATTESTED"
taskStatus string or null required
Null for ACCESS_ONLY items.
accessStatus string or null required
Null when no access record exists.
source string required
TASK: a task on the case. ACCESS_ONLY: access detected with no task; it is attached to the leaver's most recent case. MANUAL_TASK: a step that is not tied to an application.
"TASK" | "ACCESS_ONLY" | "MANUAL_TASK"
openedAt string (date-time) required
Opening time of the owning case.
taskCompletedAt string (date-time) or null required
When a person marked the task done. There is no "revoked at" field, because access detection time is not a scan time; use this field.
accessLastDetectedAt string (date-time) or null required

The meta field:

limit integer required
offset integer required
total integer required
summary object required
Counts of leaver items per reconciled status. total is the sum of the four.
- total integer required
  minimum 0
- revoked integer required
  minimum 0
- outstanding integer required
  minimum 0
- discrepancy integer required
  minimum 0
- attested integer required
  minimum 0
accessDataAsOf string (date-time) or null required
Latest access detection time used for this response.

Errors

Status	Code	Retry	Meaning
400	`VALIDATION_FAILED`	no	Invalid query parameter. code VALIDATION_FAILED; args.parameter names the parameter, args.reason the rule, args.allowed the permitted values of an enum.
401	`INVALID_TOKEN`	no	Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402	`FEATURE_GATED`	no	The tenant plan does not include lifecycle workflows. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403	`INSUFFICIENT_SCOPE`	no	The token lacks the jml:read scope (INSUFFICIENT_SCOPE; a token holding pii:read alone reaches no endpoint here), or the request is refused (FORBIDDEN). A token holding pii:read is also refused with INSUFFICIENT_SCOPE when personal data cannot be disclosed to it (personal-data disclosure is disabled for the tenant, or the token has no creator); it is never silently downgraded to the masked shape.
422	`QUERY_TOO_BROAD`	no	The filtered feed exceeds the server limit and is never truncated. code QUERY_TOO_BROAD; narrow by date range, caseStatus or employeeId.
429	`RATE_LIMITED`	yes	Rate limit exceeded. code RATE_LIMITED; wait Retry-After seconds. Applies to the personal-data (pii:read) request window on case endpoints, where Retry-After is the time until the window ends. That window is shared by all calls of the token, over REST and MCP; a request that fails with 503 AUDIT_UNAVAILABLE is not refunded, so retrying spends more of it. Do not build a design that depends on an exact number of requests. It also applies to concurrent feed requests on the items feeds, where Retry-After is 1. The body carries no meta.
500	`INTERNAL_ERROR`	no	Unexpected server error. code INTERNAL_ERROR; quote error.id to support.
503	`BILLING_UNAVAILABLE`	yes	A dependency is temporarily unavailable (BILLING_UNAVAILABLE), or a response containing name or email could not be audited and was withheld (AUDIT_UNAVAILABLE). Retry later.

Last reviewed: 2026-10-13

Was this page helpful?