---
title: "List audit report metadata"
method: GET
path: "/access-certification/campaign-runs/{runId}/audit-report"
tags: ["Access Certification"]
---

# List audit report metadata

`GET /access-certification/campaign-runs/{runId}/audit-report`

## Request

- Base URL: `https://console.jumpcloud.com/api/v2`
- URL: `https://console.jumpcloud.com/api/v2/access-certification/campaign-runs/{runId}/audit-report`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/docs/access-certification/campaign-runs/:runId/audit-report/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns audit report metadata and time-limited download URLs for compliance exports.
Available formats: PDF (human-readable report), CSV (spreadsheet), and JSON (machine-readable).

Each export includes a SHA-256 integrity hash (`documentHash`) for tamper detection.

**Report lifecycle**
- `generating` — Report is being created after campaign close. Poll this endpoint until ready.
- `exports_ready` — CSV and JSON are available; PDF may still be generating.
- `finalizing` — Sign-off recorded; PDF is being regenerated with attestation metadata.
- `materialized` — All artifacts including the signed PDF are ready.

Audit reports are available for closed campaign runs.

**Required permission:** `accesscertification` or `accesscertification.readonly`

## Path parameters

- `runId` string, required

## Response `200`

Audit report metadata retrieved

- JumpcloudHttpAccesscertificationAuditReportResponse
  - `campaignId` string, required
  - `campaignRunId` string, required
  - `status` 'generating' | 'exports_ready' | 'finalizing' | 'materialized', required: Audit artifact lifecycle
  - `documentHash` string: SHA-256 hash of canonical content blob (present when exports_ready+)
  - `hashAlgorithm` 'SHA-256'
  - `generatedBy` object: Always System after auto-generation at campaign close
    - `userId` string
    - `displayName` string
    - `email` string
  - `generatedAt` string, date-time: Campaign closure timestamp when auto-generation completed
  - `certifiedBy` object: First certifier — present after sign-off
    - `userId` string
    - `displayName` string
    - `email` string
  - `certifiedAt` string, date-time: UTC timestamp when sign-off was confirmed
  - `artifacts` JumpcloudHttpAccesscertificationAuditReportArtifacts: Presigned URLs — availability depends on status
    - `csv` JumpcloudHttpAccesscertificationPresignedUrl
      - `url` string, uri: Time-limited HTTPS URL for downloading an export file
      - `expiresAt` string, date-time
    - `json` JumpcloudHttpAccesscertificationPresignedUrl
      - `url` string, uri: Time-limited HTTPS URL for downloading an export file
      - `expiresAt` string, date-time
    - `pdf` JumpcloudHttpAccesscertificationPresignedUrl
      - `url` string, uri: Time-limited HTTPS URL for downloading an export file
      - `expiresAt` string, date-time
  - `reportContent` object: Optional inline Sections 2–5 JSON for in-browser render before PDF materialized

## Other responses

- `401`: Missing or invalid credentials
- `403`: Forbidden — principal not assigned or lacks required role
- `404`: Resource not found
- `default`: Unexpected error

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)