--- title: "List review items" method: GET path: "/access-certification/campaign-runs/{runId}/review-items" tags: ["Access Certification"] --- # List review items `GET /access-certification/campaign-runs/{runId}/review-items` ## Request - Base URL: `https://console.jumpcloud.com/api/v2` - URL: `https://console.jumpcloud.com/api/v2/access-certification/campaign-runs/{runId}/review-items` - Auth: API key in header `x-api-key` - TypeScript: (a function with typed inputs; its response is checked against the schema) Returns the identities under review in a campaign run. Each review item includes a frozen snapshot of the user's directory attributes at campaign activation, their current decision status, remediation progress, and reviewer chain state. Administrators see all identities in the run. Reviewers see only identities assigned to them. **Pagination** — `skip` and `limit` (default `10`, maximum `100`). **Sorting** — `display_name`, `decision`, `remediation_action` (prefix with `-` for descending). **Filtering** — Repeat `filter` for multiple clauses. Format: `field:operator:value` - `actionable:eq:true` — (Administrators only) Identities awaiting an administrator-stage decision. Use this to find work items from the admin queue. - `decision:eq|in:pending|keep|revoke|in_progress` — Filter by overall decision status - `remediationAction:eq|in:pending|no_action|scheduled|completed|failed|canceled` — Filter by remediation status - `directoryStatus:eq|in:` — Filter by directory status (frozen at activation; alias: `userStatus`) - `employeeType:eq|in:` — Filter by employee type (frozen at activation) - `department:eq|in:` — Filter by department (pipe-separated for multiple values) - `costCenter:eq|in:` — Filter by cost center - `company:eq|in:` — Filter by company - `lastAccessedAt:gt|ge|lt|le:` — Filter by last SSO login (application-scoped campaigns only) - `name:search:` — Search by display name, email, or username **Filter metadata** — Set `metadata=true` to receive distinct values for `departments`, `companies`, `costCenters`, `employeeTypes`, and `directoryStatuses` to populate filter dropdowns. **Required permission:** `accesscertification` or `accesscertification.readonly` ## Path parameters - `runId` string, required ## Query parameters - `skip` integer: Number of results to skip - `limit` integer: Maximum number of results to return - `sort` string - `filter` string[] - `metadata` boolean ## Response `200` Review items retrieved successfully - JumpcloudHttpAccesscertificationReviewItemListResponse - `totalCount` integer, required - `results` JumpcloudHttpAccesscertificationReviewItemResponse[], required - `id` string, required: Review item ID - `campaignId` string, required - `campaignRunId` string, required - `identityId` string, required - `finalDecision` 'pending' | 'keep' | 'revoke', required: Recorded outcome for an identity or stage - `remediationAction` 'no_action' | 'pending' | 'scheduled' | 'completed' | 'failed' | 'canceled', required: Remediation status for one identity after a Revoke decision - `remediationActionError` string: User-facing error when remediationAction is failed - `beforeSnapshot` JumpcloudHttpAccesscertificationBeforeSnapshot, required: Point-in-time identity context frozen at activate - `identityId` string - `username` string - `email` string - `displayName` string - `jobTitle` string - `department` string - `managerName` string - `userState` string: Directory user state at activate - `directoryStatus` string: Directory status shown in users-in-scope filters / expansion (raw snapshot value) - `employeeType` string: Employee type for users-in-scope filters / expansion (raw snapshot value) - `costCenter` string: Org cost center code / label - `company` string: Company name from directory - `userGroupName` string - `userGroupId` string - `applicationName` string - `applicationId` string - `associationTimestampUtc` string, date-time: When access was granted — group membership for group scope; later of group membership and app-to-group binding for application scope (frozen at activate) - `provisionedAt` string, date-time: Application-to-group binding timestamp (application scope only; frozen at activate) - `reviewerStages` JumpcloudHttpAccesscertificationReviewerStageStatus[] - `stageIndex` integer - `reviewerType` string - `reviewerDisplayName` string: Display name for the reviewer (resolved from Directory when available) - `reviewerUserId` string - `decision` 'pending' | 'keep' | 'revoke': Recorded outcome for an identity or stage - `decidedAt` string, date-time - `stageDeadlineAt` string, date-time: Computed per-reviewer deadline for sequential chains (not persisted) - `justification` string - `isCurrentReviewer` boolean: True when the authenticated principal is the active reviewer for this stage - `actorType` 'reviewer' | 'admin_override' | 'if_no_response': Decision actor classification for the deciding row on this stage. `admin_override` when an administrator overrode the stage decision. - `isAdminOverride` boolean: True when the deciding actor for this stage was an administrator override - `currentStageIndex` integer: Active reviewer stage (sequential chains) - `assignedReviewerUserId` string: Current assignee for this identity - `reassignments` JumpcloudHttpAccesscertificationReviewItemReassignment[]: Ordered reassignment events on the audit trail. Each entry records the prior reviewer, new reviewer, and justification. - `stageIndex` integer - `fromReviewerUserId` string: Reviewer who held the item before this reassignment - `fromReviewerDisplayName` string: Display name for fromReviewerUserId (resolved via the same directory/search path as reviewerDisplayName) - `toReviewerUserId` string: Newly assigned reviewer added to the chain - `toReviewerDisplayName` string: Display name for toReviewerUserId (resolved via the same directory/search path as reviewerDisplayName) - `justification` string: Required justification recorded on the audit trail - `createdByUserId` string: Actor who performed the reassignment (may be an admin on behalf) - `createdByDisplayName` string: Display name for createdByUserId (resolved via the same directory/search path as reviewerDisplayName) - `createdAt` string, date-time - `accessChangedExternally` boolean: When `true`, the identity's live Directory membership differs from the frozen snapshot captured at campaign activation. Omitted when not yet evaluated. - `lastAccessedAt` string, date-time: SSO last login from search-api authentication.last_login (application scope; frozen at activate; display only) - `metadata` JumpcloudHttpAccesscertificationReviewItemListMetadata: Distinct frozen snapshot values for filter dropdowns on a campaign run - `departments` string[] - `companies` string[] - `costCenters` string[] - `employeeTypes` string[] - `directoryStatuses` string[] ## Other responses - `401`: Missing or invalid credentials - `403`: Forbidden — principal not assigned or lacks required role - `404`: Resource not found - `default`: Unexpected error --- [API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)