docs

List joiner cases

GET /jml/onboarding/cases

Scope jml:read Plan Seed+

Lists joiner (on-boarding) cases with a reconciled summary of their items: GRANTED when the access is detected in the inventory, ATTESTED when a person confirmed it, else PENDING. Requires the jml:read scope; employee name and email are returned only for tokens that also hold pii:read, which are subject to a per-token request window (429 RATE_LIMITED).

Example

curl "https://api.autociso.io/api/v1/jml/onboarding/cases" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "caseId": "lfc_example000002",
      "employee": {
        "employeeId": "empl_example000002",
        "emailMasked": "a***@example.com",
        "department": "Sales",
        "jobTitle": "Account Executive",
        "employmentType": "FULL_TIME",
        "employeeStatus": "ACTIVE",
        "startDate": "2026-10-01"
      },
      "status": "IN_PROGRESS",
      "openedAt": "2026-09-25T08:00:00Z",
      "dueAt": "2026-10-01T08:00:00Z",
      "summary": {
        "total": 3,
        "granted": 1,
        "pending": 1,
        "attested": 1
      },
      "ready": false,
      "overdue": true,
      "generatedAt": "2026-09-25T08:00:00Z",
      "generatedFromProfileIds": [
        "aprf_example000001"
      ]
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 1,
    "accessDataAsOf": "2026-09-29T02:00:00Z"
  }
}

Query parameters

  • limit integer
    Page size. Default 25, maximum 100; a larger value is rejected with 400 VALIDATION_FAILED. minimum 1, maximum 100, default 25
  • offset integer
    Zero-based offset. Maximum 100000. minimum 0, maximum 100000, default 0
  • sort[openedAt] string
    "asc" | "desc"
  • sort[dueAt] string
    "asc" | "desc"
  • filter[status][eq] string
    Case status. CANCELLED cases are excluded unless an eq or in filter names CANCELLED.
    "OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
  • filter[status][ne] string
    "OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
  • filter[status][in] array of string
    maxItems 100
    "OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
  • filter[employeeId][eq] string
    pattern ^empl_[A-Za-z0-9_-]{1,59}$
  • filter[employeeId][in] array of string
    maxItems 100
  • filter[openedAt][gt] string (date-time)
  • filter[openedAt][gte] string (date-time)
  • filter[openedAt][lt] string (date-time)
  • filter[openedAt][lte] string (date-time)
  • filter[dueAt][gt] string (date-time)
  • filter[dueAt][gte] string (date-time)
  • filter[dueAt][lt] string (date-time)
  • filter[dueAt][lte] string (date-time)

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • caseId string required
  • employee object required
    Identity block of a case. Only employeeId is guaranteed; the other fields are absent when unknown or not disclosed.
    • employeeId string required
      Internal employee id.
    • emailMasked string
      Masked email address, safe to display.
    • name string
      Full name. Present only for tokens holding both jml:read and pii:read; without pii:read the key is absent.
    • email string
      Email address. Present only for tokens holding both jml:read and pii:read; without pii:read the key is absent.
    • department string
    • jobTitle string
    • employmentType string
    • employeeStatus string
    • startDate string (date)
      Calendar date YYYY-MM-DD.
    • endDate string (date)
      Calendar date YYYY-MM-DD.
  • status string required
    Case status, returned as stored; it is not derived from the item statuses. Use ready and overdue for the reconciled picture.
    "OPEN" | "IN_PROGRESS" | "COMPLETED" | "CANCELLED"
  • openedAt string (date-time) required
  • dueAt string (date-time) or null required
  • summary object required
    Counts of joiner items per reconciled status. total is the sum of the three.
    • total integer required
      minimum 0
    • granted integer required
      minimum 0
    • pending integer required
      minimum 0
    • attested integer required
      minimum 0
  • ready boolean required
    True when no item is pending (every item is granted or attested).
  • overdue boolean required
    True when an open case that is not ready is past its due date.
  • generatedAt string (date-time) or null required
    When the items were generated from access profiles; null for cases created otherwise.
  • generatedFromProfileIds array of string required
    Ids of the access profiles the items were generated from (ids only). Empty, never null.

The meta field:

  • limit integer required
  • offset integer required
  • total integer required
  • accessDataAsOf string (date-time) or null required
    Latest access detection time used for this response.

Errors

Status Code Retry Meaning
400 VALIDATION_FAILED no Invalid query parameter. code VALIDATION_FAILED; args.parameter names the parameter, args.reason the rule, args.allowed the permitted values of an enum.
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include lifecycle workflows. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the jml:read scope (INSUFFICIENT_SCOPE; a token holding pii:read alone reaches no endpoint here), or the request is refused (FORBIDDEN). A token holding pii:read is also refused with INSUFFICIENT_SCOPE when personal data cannot be disclosed to it (personal-data disclosure is disabled for the tenant, or the token has no creator); it is never silently downgraded to the masked shape.
429 RATE_LIMITED yes Rate limit exceeded. code RATE_LIMITED; wait Retry-After seconds. Applies to the personal-data (pii:read) request window on case endpoints, where Retry-After is the time until the window ends. That window is shared by all calls of the token, over REST and MCP; a request that fails with 503 AUDIT_UNAVAILABLE is not refunded, so retrying spends more of it. Do not build a design that depends on an exact number of requests. It also applies to concurrent feed requests on the items feeds, where Retry-After is 1. The body carries no meta.
500 INTERNAL_ERROR no Unexpected server error. code INTERNAL_ERROR; quote error.id to support.
503 BILLING_UNAVAILABLE yes A dependency is temporarily unavailable (BILLING_UNAVAILABLE), or a response containing name or email could not be audited and was withheld (AUDIT_UNAVAILABLE). Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc