Leaver Reconciliation in the Console and Over REST

Leaver reconciliation, in the console and over REST

Plans: The Seed and above (Employee lifecycle) Where: Lifecycle (JML), tab Leaver (Offboarding); user menu → API Tokens; /api/v1/jml/

When someone leaves, AutoCISO opens a leaver case with one “revoke” task per application. Until now the task list only showed what a person had ticked, so you could not tell which access was really gone. This release compares the tasks with what the latest access data shows.

Who benefits: the IT manager closing out leavers, and the engineer or MSP who wants a nightly list for a ticketing tool.

What’s new

Four statuses for every leaver item

Each item is Revoked, Outstanding, a Discrepancy (marked as done, but the access is still detected) or Marked done, unverified. The Leaver (Offboarding) tab shows the counts per case (“2 revoked”, “1 outstanding”, “1 discrepancy”), a Clean tag when nothing needs attention, and this message: “1 item was marked as done but the access is still detected. Check it first.” Use Show only these or Needs attention to focus, and Show items to see the Access, Task status, Inventory status, Status and Last seen columns. The page shows Open leaver cases, Outstanding items and Discrepancies at the top, and Latest detection with a date — the newest time the access data was seen, not the time of a scan.

Leaver case items are not the same list as Offboarding violations: terminated employees who still have access but no leaver case appear in Offboarding violations (the CISO report and the access_offboarding_violations MCP tool), not here.

A read-only off-boarding API

Four endpoints under /api/v1/jml/ return leaver cases and their items. Use the feed to poll for outstanding and discrepant access, and de-duplicate on itemKey. Requests are limited per token; honour the Retry-After header on a 429. An OpenAPI file is published for client generation.

A new token scope: jml:read

In user menu → API Tokens → Create Token, an organisation Owner or Manager can tick jml:read — Read joiner/leaver status under Employee lifecycle. It needs an expiry of at most 365 days (90 days when combined with pii:read, which adds names and emails). The responses are pseudonymised personal data: handle them accordingly.

Token use in the Audit Trail

Entries made by an API token show an API token badge next to the actor.

How to use it

1. Open Lifecycle (JML), tab Leaver (Offboarding), and check Needs attention.
2. For the API, create a jml:read token in user menu → API Tokens.
3. Follow Poll off-boarding discrepancies nightly; the endpoints are described in the Off-boarding API.

Rollout

The off-boarding API is switched on per deployment. Where it is not yet enabled, the endpoints answer 403 FORBIDDEN.