docs

List the items of a joiner case

GET /jml/onboarding/cases/{caseId}/items

Scope jml:read Plan Seed+

Lists the reconciled items of one joiner case. The status is evaluated at read time: an item turns GRANTED as soon as the access is detected, without any change to the case. meta.summary counts the whole filtered set before pagination.

Example

curl "https://api.autociso.io/api/v1/jml/onboarding/cases/<caseId>/items" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "itemId": "ltsk_example000002",
      "itemKey": "lfc_example000002:ast_example000002",
      "taskId": "ltsk_example000002",
      "caseId": "lfc_example000002",
      "employeeId": "empl_example000002",
      "assetId": "ast_example000002",
      "assetName": "Example Chat",
      "status": "GRANTED",
      "accessStatus": "ACTIVE",
      "accessLastDetectedAt": "2026-09-29T02:00:00Z",
      "sourceProfileIds": [
        "aprf_example000001"
      ],
      "attestedAt": null,
      "source": "PROFILE",
      "openedAt": "2026-09-25T08:00:00Z",
      "dueAt": "2026-10-01T08:00:00Z"
    },
    {
      "itemId": "ltsk_example000003",
      "itemKey": "lfc_example000002:ltsk_example000003",
      "taskId": "ltsk_example000003",
      "caseId": "lfc_example000002",
      "employeeId": "empl_example000002",
      "assetId": null,
      "assetName": null,
      "status": "ATTESTED",
      "accessStatus": null,
      "accessLastDetectedAt": null,
      "sourceProfileIds": [],
      "attestedAt": "2026-09-26T09:15:00Z",
      "source": "MANUAL_TASK",
      "openedAt": "2026-09-25T08:00:00Z",
      "dueAt": "2026-10-01T08:00:00Z"
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 2,
    "summary": {
      "total": 2,
      "granted": 1,
      "pending": 0,
      "attested": 1
    },
    "accessDataAsOf": "2026-09-29T02:00:00Z"
  }
}

Path parameters

  • caseId string required
    Joiner case id (lfc_...). An unknown, foreign, leaver or malformed id returns the same 404. pattern ^lfc_[A-Za-z0-9_-]{1,59}$

Query parameters

  • limit integer
    Page size. Default 25, maximum 100; a larger value is rejected with 400 VALIDATION_FAILED. minimum 1, maximum 100, default 25
  • offset integer
    Zero-based offset. Maximum 100000. minimum 0, maximum 100000, default 0
  • filter[status][eq] string
    Reconciled item status.
    "GRANTED" | "PENDING" | "ATTESTED"
  • filter[status][ne] string
    "GRANTED" | "PENDING" | "ATTESTED"
  • filter[status][in] array of string
    maxItems 100
    "GRANTED" | "PENDING" | "ATTESTED"

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • itemId string required
  • itemKey string required
    Stable key for deduplicating items across polls: caseId:assetId, or caseId:taskId for a manual task.
  • taskId string or null required
  • caseId string required
  • employeeId string required
  • assetId string or null required
    Null for MANUAL_TASK items. Older assets may carry a 24-character hex asset id.
  • assetName string or null required
    Current name of the application; the name at generation when the application no longer exists; null for manual items.
  • status string required
    Reconciled each time you read it, so an item turns GRANTED as soon as the access is detected, with no change to the case. GRANTED: the access inventory shows the access; nothing to do. PENDING: no access is detected and nobody has marked it done; give the access, then wait for the next access scan. ATTESTED: a person marked it done in the console (shown as Marked done) but the access is not yet detected; neither verified nor contradicted. Verify if it matters.
    "GRANTED" | "PENDING" | "ATTESTED"
  • accessStatus string or null required
    Null when no access record exists.
  • accessLastDetectedAt string (date-time) or null required
  • sourceProfileIds array of string required
    Ids of the access profiles that required the application (ids only). Empty, never null.
  • attestedAt string (date-time) or null required
    When a person marked the item done in the console. Null when nobody has.
  • source string required
    "PROFILE" | "MANUAL_TASK"
  • openedAt string (date-time) required
    Opening time of the owning case.
  • dueAt string (date-time) or null required
    Due date of the owning case.

The meta field:

  • limit integer required
  • offset integer required
  • total integer required
  • summary object required
    Counts of joiner items per reconciled status. total is the sum of the three.
    • total integer required
      minimum 0
    • granted integer required
      minimum 0
    • pending integer required
      minimum 0
    • attested integer required
      minimum 0
  • accessDataAsOf string (date-time) or null required
    Latest access detection time used for this response.

Errors

Status Code Retry Meaning
400 VALIDATION_FAILED no Invalid query parameter. code VALIDATION_FAILED; args.parameter names the parameter, args.reason the rule, args.allowed the permitted values of an enum.
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include lifecycle workflows. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the jml:read scope (INSUFFICIENT_SCOPE; a token holding pii:read alone reaches no endpoint here), or the request is refused (FORBIDDEN). A token holding pii:read is also refused with INSUFFICIENT_SCOPE when personal data cannot be disclosed to it (personal-data disclosure is disabled for the tenant, or the token has no creator); it is never silently downgraded to the masked shape.
404 NOT_FOUND no Unknown, foreign-tenant, wrong-type or malformed case id. Always the same body.
429 RATE_LIMITED yes Rate limit exceeded. code RATE_LIMITED; wait Retry-After seconds. Applies to the personal-data (pii:read) request window on case endpoints, where Retry-After is the time until the window ends. That window is shared by all calls of the token, over REST and MCP; a request that fails with 503 AUDIT_UNAVAILABLE is not refunded, so retrying spends more of it. Do not build a design that depends on an exact number of requests. It also applies to concurrent feed requests on the items feeds, where Retry-After is 1. The body carries no meta.
500 INTERNAL_ERROR no Unexpected server error. code INTERNAL_ERROR; quote error.id to support.
503 BILLING_UNAVAILABLE yes A dependency is temporarily unavailable (BILLING_UNAVAILABLE), or a response containing name or email could not be audited and was withheld (AUDIT_UNAVAILABLE). Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc