Skip to content
GitmoapAPIBeta
Schema

AccessReviewPage

The access review: every grant in the organization with a reason to look at it, oldest first.

A page can hold fewer items than asked for while more remain — the review reads a bounded stretch of the organization's grants per request — so keep reading while next_token is present.

Shape

  • itemsarray of AccessReviewItem
    • The AccessReviewItem schema
    • grantAccessGrant
      • The AccessGrant schema
      • created_atstring · date-time
      • grant_idGrantId (string · uuid)
      • roleRoleView
        • The RoleView schema
        • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
        • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
        • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
        • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
      • scopeAccessScopeWhere the grant was made.
      • updated_atstring · date-time
      • expires_atstring · date-time or nulloptional
      • granted_byActorSummary or nulloptionalWho made the grant. Absent for access the platform created — the creator of a group or repository, or a copied membership.
      • last_exercised_atstring · date-time or nulloptionalWhen the grant last let somebody do something, to the day. Absent until it has.
      • reasonstring or nulloptional
    • reasonsarray of AccessReviewReason: one of expiring | sensitive | unused | redundant | outside_collaborator | service_account
    • covered_byarray of AccessGrantoptionalFor a redundant grant: the grants that already give everything it does, so the reviewer can see why revoking it takes nothing away.
      • The AccessGrant schema
      • created_atstring · date-time
      • grant_idGrantId (string · uuid)
      • roleRoleView
        • The RoleView schema
        • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
        • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
        • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
        • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
      • scopeAccessScopeWhere the grant was made.
      • updated_atstring · date-time
      • expires_atstring · date-time or nulloptional
      • granted_byActorSummary or nulloptionalWho made the grant. Absent for access the platform created — the creator of a group or repository, or a copied membership.
      • last_exercised_atstring · date-time or nulloptionalWhen the grant last let somebody do something, to the day. Absent until it has.
      • reasonstring or nulloptional
  • next_tokenstring or nulloptional

Example

Synthesized example
{
"items": [
{
"grant": {
"created_at": "2026-10-14T21:40:40Z",
"grant_id": "b0bd1f07-5483-40ab-85e8-5993af07f8e6",
"role": {
"name": "payments-api",
"rank": "guest"
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-03f2",
"type": "group"
},
"subject": {
"principal": {}
},
"updated_at": "2026-10-13T11:51:55Z"
},
"reasons": []
}
],
"next_token": "next-token-9d09"
}

Graph

Used inside

No schema contains this one.

Used by

Sent by 0 operations

No operation takes it as a request body.