AccessReviewPage
The access review: every grant in the organization with a reason to look at it, oldest first.
A page can hold fewer items than asked for while more remain — the review reads a bounded
stretch of the organization's grants per request — so keep reading while next_token is
present.
Shape
itemsarray of AccessReviewItem
- The AccessReviewItem schema
grantAccessGrant
- The AccessGrant schema
- created_atstring · date-time
- grant_idGrantId (string · uuid)
roleRoleView
- The RoleView schema
- namestringThe role's display name: a built-in name such as
Developer, or the custom role's name. - rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
- builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
- customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
scopeAccessScopeWhere the grant was made.
- The AccessScope schema
- full_pathstring
- idstring
- typeScopeTypegrouprepository
- subjectGrantSubject
- updated_atstring · date-time
- expires_atstring · date-time or nulloptional
granted_byActorSummary or nulloptionalWho made the grant. Absent for access the platform created — the creator of a group or repository, or a copied membership.
- The ActorSummary schema
- emailstring
- idstring
- usernamestring
- avatar_urlstring or nulloptional
- last_exercised_atstring · date-time or nulloptionalWhen the grant last let somebody do something, to the day. Absent until it has.
- reasonstring or nulloptional
- reasonsarray of AccessReviewReason: one of expiring | sensitive | unused | redundant | outside_collaborator | service_account
covered_byarray of AccessGrantoptionalFor a redundant grant: the grants that already give everything it does, so the reviewer can see why revoking it takes nothing away.
- The AccessGrant schema
- created_atstring · date-time
- grant_idGrantId (string · uuid)
roleRoleView
- The RoleView schema
- namestringThe role's display name: a built-in name such as
Developer, or the custom role's name. - rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
- builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
- customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
scopeAccessScopeWhere the grant was made.
- The AccessScope schema
- full_pathstring
- idstring
- typeScopeTypegrouprepository
- subjectGrantSubject
- updated_atstring · date-time
- expires_atstring · date-time or nulloptional
granted_byActorSummary or nulloptionalWho made the grant. Absent for access the platform created — the creator of a group or repository, or a copied membership.
- The ActorSummary schema
- emailstring
- idstring
- usernamestring
- avatar_urlstring or nulloptional
- last_exercised_atstring · date-time or nulloptionalWhen the grant last let somebody do something, to the day. Absent until it has.
- reasonstring or nulloptional
- next_tokenstring or nulloptional
Example
Synthesized example{
"items": [
{
"grant": {
"created_at": "2026-10-14T21:40:40Z",
"grant_id": "b0bd1f07-5483-40ab-85e8-5993af07f8e6",
"role": {
"name": "payments-api",
"rank": "guest"
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-03f2",
"type": "group"
},
"subject": {
"principal": {}
},
"updated_at": "2026-10-13T11:51:55Z"
},
"reasons": []
}
],
"next_token": "next-token-9d09"
}
Graph
Used inside
No schema contains this one.
Contains
Used by
Sent by 0 operations
No operation takes it as a request body.