---
title: "Sign off audit report"
method: POST
path: "/api/v2/access-certification/campaign-runs/{runId}/audit-report/sign-off"
tags: ["Access Certification"]
---

# Sign off audit report

`POST /api/v2/access-certification/campaign-runs/{runId}/audit-report/sign-off`

## Request

- Base URL: `https://console.jumpcloud.com`
- URL: `https://console.jumpcloud.com/api/v2/access-certification/campaign-runs/{runId}/audit-report/sign-off`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/docs/api/v2/access-certification/campaign-runs/:runId/audit-report/sign-off/post.ts> (a function with typed inputs; its response is checked against the schema)

Records an optional compliance attestation on a closed campaign's audit report. After sign-off,
the report includes who certified it (`certifiedBy`) and when (`certifiedAt`), and the
document hash is recomputed to include attestation metadata.

The PDF is regenerated asynchronously after sign-off. Poll `GET .../audit-report` until
status is `materialized`.

This operation is idempotent — calling it again after a successful sign-off returns the
existing attestation without creating a duplicate.

**Required permission:** `accesscertification` (Full Access)

## Path parameters

- `runId` string, required

## Request body

- JumpcloudHttpAccesscertificationSignOffAuditReportRequest: Sign-off attestation confirmation
  - `confirmed` boolean: Client attests sign-off modal was accepted

## Response `200`

Already signed off (idempotent)

- JumpcloudHttpAccesscertificationSignOffAuditReportResponse
  - `campaignId` string, required
  - `campaignRunId` string, required
  - `status` 'finalizing' | 'materialized', required
  - `documentHash` string: Authoritative SHA-256 hash including sign-off metadata
  - `certifiedBy` object
    - `userId` string
    - `displayName` string
    - `email` string
  - `certifiedAt` string, date-time
  - `idempotent` boolean: True when sign-off was already recorded by a prior certifier

## Other responses

- `202`: Sign-off accepted; PDF regenerate enqueued
- `401`: Missing or invalid credentials
- `403`: Forbidden — principal not assigned or lacks required role
- `404`: Resource not found
- `409`: Conflict — resource state prevents the requested action
- `default`: Unexpected error

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/revisions/f396d9271b46?raw)