---
title: "Get campaign template"
method: GET
path: "/access-certification/campaigns/{campaignId}"
tags: ["Access Certification"]
---

# Get campaign template

`GET /access-certification/campaigns/{campaignId}`

## Request

- Base URL: `https://console.jumpcloud.com/api/v2`
- URL: `https://console.jumpcloud.com/api/v2/access-certification/campaigns/{campaignId}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/docs/access-certification/campaigns/:campaignId/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a campaign template's full configuration and, if one exists, a summary of its
current or most recent run (status, review window, progress).

**Required permission:** `accesscertification` or `accesscertification.readonly`

## Path parameters

- `campaignId` string, required

## Response `200`

Campaign retrieved successfully

- JumpcloudHttpAccesscertificationCampaignResponse: Campaign template plus optional active run summary
  - `id` string, required
  - `orgId` string, required
  - `status` 'scheduled' | 'active' | 'completed' | 'canceled', required: Lifecycle status of a campaign template on read responses. Create and update requests only accept `scheduled`. Activate transitions to `active`; close or end-early ends as `completed` or `canceled`. When Access Certification is disabled, this status field is unchanged, but create and activate are blocked. Viewing, editing scheduled templates, finalizing runs, and downloading audit reports remain available.
  - `config` JumpcloudHttpAccesscertificationCampaignConfig, required: Full campaign template configuration
    - `name` string, required: Campaign name
    - `description` string: Optional campaign description
    - `enabled` boolean: Campaign status toggle
    - `scope` JumpcloudHttpAccesscertificationScopeConfig, required: Campaign review scope — which SSO application or user group identities are certified. Exactly one user group is supported per campaign.
      - `scopeType` 'application' | 'group', required: What the campaign reviews — an SSO application or a user group
      - `applicationId` string: Required when scopeType is application — SSO application ID
      - `userGroupId` string: Required when scopeType is group — ID of the user group under review
    - `schedule` JumpcloudHttpAccesscertificationScheduleConfig, required: Campaign schedule — one-time or recurring, start date, and review duration
      - `frequency` 'one_time' | 'recurring', required
      - `cadence` 'monthly' | 'quarterly' | 'semi_annual' | 'annual': How often a recurring campaign runs (monthly, quarterly, semi-annual, or annual)
      - `reviewStartAt` string, date-time, required: Review window start (UTC). Minimum 30 minutes from create time.
      - `reviewDurationDays` integer, required: Review duration in calendar days
    - `reviewerChain` JumpcloudHttpAccesscertificationReviewerChainConfig, required: Reviewer chain configuration — who reviews each identity, in what order, and under what completion rules.
      - `stages` JumpcloudHttpAccesscertificationReviewerStageConfig[], required
        - `stageIndex` integer, required: 1-based stage order
        - `reviewerType` 'administrator' | 'users_manager' | 'resource_owner' | 'user_group', required: Reviewer stage type
        - `fallbackApproverUserId` string: Required when reviewerType is users_manager
        - `resourceOwnerUserId` string: Required when reviewerType is resource_owner
        - `reviewerUserGroupId` string: Required when reviewerType is user_group
        - `allGroupMembersMustReview` boolean: When reviewerType is user_group — all members must decide
      - `completionMode` 'any' | 'all' | 'sequential': How decisions from multiple reviewer stages combine. - `any` — One Keep or Revoke from any stage is final - `all` — All stages must agree - `sequential` — Stages proceed in order; each reviewer has a response window
      - `responseWindowDaysPerReviewer` integer: Required when completionMode is sequential
      - `requireJustification` boolean
      - `allowReassign` boolean
    - `remediationPolicy` JumpcloudHttpAccesscertificationRemediationPolicy, required: Remediation policy — what happens when access is revoked or when reviewers do not respond before the review window closes.
      - `onRevoke` 'no_action' | 'suspend_identity' | 'remove_user_from_group', required: Automated action taken when a final Revoke decision is recorded
      - `ifNoResponse` 'no_action' | 'automatic_removal' | 'suspend_identity', required: What happens to identities with no reviewer decision when the review window closes
      - `remediationDelayDays` integer, required: Days after review close before remediation runs (0 = immediate-on-revoke)
      - `remediationCustomAt` string, date-time: Absolute UTC remediation time; mutually exclusive with remediationDelayDays > 0
    - `notificationPreferences` JumpcloudHttpAccesscertificationCampaignNotificationPreferences: Per-campaign notification preferences. When creating a campaign, access certification settings serve as the default starting point.
      - `platforms` JumpcloudHttpAccesscertificationCampaignNotificationPlatform[], required: Email, Slack, and/or Webhook platform configuration
        - `type` 'email' | 'slack' | 'webhook', required: Notification delivery platform
        - `enabled` boolean, required: Whether this platform is enabled for campaign notifications
        - `channelIds` string[], required: Channel ids for this platform (email lists/mailboxes, Slack channels, or webhook endpoints). Values are JumpCloud Notifications channel IDs.
  - `currentRun` JumpcloudHttpAccesscertificationCampaignRunSummary: Current or most recent run summary on campaign detail
    - `runId` string
    - `status` 'active' | 'closed' | 'canceled': Active, closed, or canceled run state
    - `reviewWindowStart` string, date-time
    - `reviewWindowEnd` string, date-time
    - `reviewProgressPercent` integer
    - `remediationStatus` 'not_started' | 'no_action' | 'in_progress' | 'scheduled' | 'completed' | 'failed' | 'canceled': Overall remediation status for a campaign run. Reflects the campaign's remediation policy and per-identity progress — not review completion percentage alone. - `no_action` — Remediation policy does not require automated action on revoke - `failed` — Deprecated at campaign level; per-identity failures surface on review items while process completion uses `completed`
    - `activatedAt` string, date-time
    - `closedAt` string, date-time
    - `materializationStatus` 'in_progress' | 'complete' | 'failed': Cohort materialization progress while review items are created at activate
    - `reviewItemsMaterialized` integer: Review items materialized so far for this run
    - `scope` JumpcloudHttpAccesscertificationCampaignRunScope: Review scope for a campaign run, including the target application or user groups and optional resource counts from Directory.
      - `type` 'application' | 'group', required: What the campaign reviews — an SSO application or a user group
      - `applicationId` string: Set when type is application
      - `applicationName` string: Display name when known (activate snapshot / Directory); omit when unresolved
      - `userGroups` JumpcloudHttpAccesscertificationUserGroup[]: In-scope user groups (ID and optional name). Group-scoped campaigns currently support one user group.
        - `id` string, required: User group object id
        - `name` string: Display name when known; omit when unresolved
      - `resourceCounts` JumpcloudHttpAccesscertificationGroupResourceCounts[]: Per user-group resource counts from the Directory (each user group is counted independently).
        - `userGroupId` string, required: User group object id these counts belong to
        - `counts` object, required: Map of directory type key to count (e.g. user, application, ldap_server). Keys omitted when the graph edge is unsupported or the count call failed.
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Validation error with field-level details
- `401`: Missing or invalid credentials
- `403`: Forbidden — principal not assigned or lacks required role
- `404`: Resource not found
- `default`: Unexpected error

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)