# Leaver Reconciliation in the Console and Over REST
URL: https://docs.autociso.io/release-notes/2026-09-offboarding-api/
Description: See which leaver access is really revoked, still outstanding, or marked done while still detected — in the Leaver tab and through a new read-only jml:read API.

## Leaver reconciliation, in the console and over REST

**Plans:** The Seed and above (Employee lifecycle)
**Where:** **Lifecycle (JML)**, tab **Leaver (Offboarding)**; **user menu → API Tokens**; `/api/v1/jml/`

When someone leaves, AutoCISO opens a leaver case with one "revoke" task per application. Until now the task list only showed what a person had ticked, so you could not tell which access was really gone. This release compares the tasks with what the latest access data shows.

**Who benefits:** the IT manager closing out leavers, and the engineer or MSP who wants a nightly list for a ticketing tool.

### What's new

#### Four statuses for every leaver item

Each item is **Revoked**, **Outstanding**, a **Discrepancy** (marked as done, but the access is still detected) or **Marked done, unverified**. The **Leaver (Offboarding)** tab shows the counts per case ("2 revoked", "1 outstanding", "1 discrepancy"), a **Clean** tag when nothing needs attention, and this message: "1 item was marked as done but the access is still detected. Check it first." Use **Show only these** or **Needs attention** to focus, and **Show items** to see the **Access**, **Task status**, **Inventory status**, **Status** and **Last seen** columns. The page shows **Open leaver cases**, **Outstanding items** and **Discrepancies** at the top, and **Latest detection** with a date — the newest time the access data was seen, not the time of a scan.

Leaver case items are not the same list as Offboarding violations: terminated employees who still have access but no leaver case appear in Offboarding violations (the CISO report and the `access_offboarding_violations` MCP tool), not here.

#### A read-only off-boarding API

Four endpoints under `/api/v1/jml/` return leaver cases and their items. Use the feed to poll for outstanding and discrepant access, and de-duplicate on `itemKey`. Requests are limited per token; honour the `Retry-After` header on a `429`. An [OpenAPI file](https://docs.autociso.io/openapi/public-v1.yaml) is published for client generation.

#### A new token scope: `jml:read`

In **user menu → API Tokens → Create Token**, an organisation **Owner** or **Manager** can tick **jml:read — Read joiner/leaver status** under **Employee lifecycle**. It needs an expiry of at most 365 days (90 days when combined with `pii:read`, which adds names and emails). The responses are pseudonymised personal data: handle them accordingly.

#### Token use in the Audit Trail

Entries made by an API token show an **API token** badge next to the actor.

### How to use it

1. Open **Lifecycle (JML)**, tab **Leaver (Offboarding)**, and check **Needs attention**.
2. For the API, create a `jml:read` token in **user menu → API Tokens**.
3. Follow [Poll off-boarding discrepancies nightly](https://docs.autociso.io/api/poll-offboarding/); the endpoints are described in the [Off-boarding API](https://docs.autociso.io/api/reference/offboarding-cases/list/).

### Rollout

The off-boarding API is switched on per deployment. Where it is not yet enabled, the endpoints answer `403 FORBIDDEN`.