User Access Reviews (UAR) attest who has access to which Application. Completing a review is an ordered flow: create an Application, load its user set, conduct a review (which opens a review period and snapshots each Application into it), complete every Application in that period, and only then complete the period itself — completing the period fails while any Application in it is still incomplete. Only one review period may be active on an account at a time.
🔒 Requires Access Review: List Access Review Applications permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "name": "AWS",
- "source": "MANUALLY_ADDED",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}Create a manually-managed Access Review Application (a system whose user access will be reviewed). Load its user set separately via PUT .../access-review-applications/:applicationId/users.
🔒 Requires Access Review: Create Access Review Application permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Created
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
An Application with this name and website URL already exists.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "name": "AWS",
- "reviewersIds": [
- 1,
- 2,
- 3
]
}{- "id": 1,
- "name": "AWS",
- "source": "MANUALLY_ADDED",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}🔒 Requires Access Review: Get Access Review Application permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "id": 1,
- "name": "AWS",
- "source": "MANUALLY_ADDED",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}Update an Access Review Application's name, vendor URL, or default reviewers. Omitted fields are left unchanged. Name and vendor URL can be changed only on manually-managed Applications; reviewers can be changed on any Application.
🔒 Requires Access Review: Update Access Review Application permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
No fields were provided, so nothing was changed.
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
An Application with this name and website URL already exists.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "name": "AWS",
- "reviewersIds": [
- 1,
- 2,
- 3
]
}{- "id": 1,
- "name": "AWS",
- "source": "MANUALLY_ADDED",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}Delete a manually-managed Access Review Application. It is also removed from any review period in which it has not been completed. The identity records (name and email) of its loaded users are retained rather than deleted.
🔒 Requires Access Review: Delete Access Review Application permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
No Content
Only manually-managed Applications can be deleted.
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "name": "string",
- "statusCode": 0,
- "message": "string",
- "code": 0
}List the user set currently loaded into an Access Review Application (see PUT .../access-review-applications/:applicationId/users).
🔒 Requires Access Review: List Access Review Application Users permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "identityId": "1a2b3c",
- "username": "jane.doe",
- "roles": [
- "Admin",
- "ReadOnly"
], - "hasAdminAccess": false,
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}Load the full set of reviewable users for a manually-managed Access Review Application. Calling this again treats the submitted list as the complete set: users omitted from it are removed from the Application and from its open review, and their identity record (name and email) is retained in a disconnected state rather than deleted. The request is rejected while the Application has been completed within its still-open review period, or once reviewers have recorded decisions in it; after that review period is completed, users can be loaded again (for example, to prepare the Application for its next review cycle).
🔒 Requires Access Review: Load Access Review Application User Set permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
required | Array of objects (AccessReviewUserIdentityRequestPublicV2Dto) <= 4000 items The Application's full set of reviewable users. Users omitted from this list are removed from the Application and its open review; their identity record (name and email) is retained in a disconnected state, not deleted. |
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
This Application has already been completed while its review period is still open, or reviewers have already recorded decisions in it. Once that review period is completed, users can be loaded again.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "identities": [
- {
- "identityId": "1a2b3c",
- "username": "jane.doe",
- "roles": [
- "Admin",
- "ReadOnly"
]
}
]
}{- "savedCount": 3
}List review periods, optionally filtered to active or completed ones.
🔒 Requires Access Review: List Access Reviews permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "startingDate": "2019-08-24T14:15:22Z",
- "endingDate": "2019-08-24T14:15:22Z",
- "completedAt": "2019-08-24T14:15:22Z",
- "applications": [
- {
- "id": 1,
- "applicationId": 1,
- "status": "NOT_STARTED"
}
]
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}Start a review period, scoping in one or more Applications and assigning reviewers. Only one review period may be active on the account at a time.
🔒 Requires Access Review: Conduct Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Created
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
Another review period is already active on this account.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "startingDate": "2025-07-01T16:45:55.246Z",
- "endingDate": "2025-07-01T16:45:55.246Z",
- "applications": [
- {
- "applicationId": 1,
- "reviewersIds": [
- 1,
- 2,
- 3
]
}
]
}{- "id": 1,
- "startingDate": "2019-08-24T14:15:22Z",
- "endingDate": "2019-08-24T14:15:22Z",
- "completedAt": "2019-08-24T14:15:22Z",
- "applications": [
- {
- "id": 1,
- "applicationId": 1,
- "status": "NOT_STARTED"
}
]
}Get a review period and the Applications scoped into it.
🔒 Requires Access Review: Get Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "id": 1,
- "startingDate": "2019-08-24T14:15:22Z",
- "endingDate": "2019-08-24T14:15:22Z",
- "completedAt": "2019-08-24T14:15:22Z",
- "applications": [
- {
- "id": 1,
- "applicationId": 1,
- "status": "NOT_STARTED"
}
]
}Get one Application within a review period, with its reviewers and counts of its users by review decision.
🔒 Requires Access Review: Get Application in Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "id": 1,
- "applicationId": 1,
- "status": "IN_PROGRESS",
- "completedAt": "2025-07-01T16:45:55.246Z",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "userCounts": {
- "notReviewed": 3,
- "approved": 10,
- "rejected": 1,
- "outOfScope": 0
}
}Reassign the reviewers of one Application within a review period. New reviewers are also added to the Application's default reviewers. Rejected once the Application or its review period has been completed.
🔒 Requires Access Review: Update Application Reviewers in Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
No fields were provided, so nothing was changed.
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
The Application or its review period has already been completed.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "reviewersIds": [
- 1,
- 2,
- 3
]
}{- "id": 1,
- "applicationId": 1,
- "status": "IN_PROGRESS",
- "completedAt": "2025-07-01T16:45:55.246Z",
- "reviewers": [
- {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "userCounts": {
- "notReviewed": 3,
- "approved": 10,
- "rejected": 1,
- "outOfScope": 0
}
}List the users under review in one Application within a review period, with each user's review decision.
🔒 Requires Access Review: List Application Users in Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "identityId": "1a2b3c",
- "username": "jane.doe",
- "roles": [
- "Admin",
- "ReadOnly"
], - "status": "APPROVED",
- "completedBy": {
- "id": 1,
- "firstName": "Sally",
- "lastName": "Smith",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}, - "lastRejectedAt": "2025-07-01T16:45:55.246Z",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}Get a short-lived signed URL for the evidence package ZIP of a review period. The package is generated in the background as Applications are completed, and covers every Application in the period.
🔒 Requires Access Review: Download Access Review Evidence Package permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
The review period does not exist, or its evidence package is not ready.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "fileBuffer": {
- "buffer": "RXhhbXBsZSB0ZXh0IGNvbnRlbnQ="
}, - "fileName": "Artifact 3.png"
}complete: mark one Application within a review period as reviewed. Every Application in a period must be completed before the period itself can be completed. If any of the Application's users are still NOT_REVIEWED, the request is rejected with 409 unless markUnreviewedUsersOutOfScope is true, which marks them OUT_OF_SCOPE, recorded as completed by the calling API key's user; users who already have a decision keep it. That sweep runs asynchronously after this call returns; confirm it through userCounts on GET .../access-review-periods/:periodId/applications/:reviewAppId.
🔒 Requires Access Review: Complete Access Review Application permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
This Application has already been completed, or still has NOT_REVIEWED users and markUnreviewedUsersOutOfScope was not set.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "action": "complete",
- "markUnreviewedUsersOutOfScope": true
}{- "id": 1,
- "applicationId": 1,
- "status": "NOT_STARTED"
}complete: complete a review period. Every Application scoped into the period must already be completed (see POST .../applications/:reviewAppId/actions).
🔒 Requires Access Review: Complete Access Review permission.
💎 Requires your account have the Access Review feature. Contact your Account Manager for help upgrading.
Successful
Malformed data and/or validation errors
Invalid Authorization
You must upgrade your plan to use this feature
You are not allowed to perform this action
Not Found
Cannot complete a review period with incomplete Applications, or the review period has already been completed.
You must accept the Drata terms and conditions to use the API
Internal server error
{- "action": "complete"
}{- "id": 1,
- "startingDate": "2019-08-24T14:15:22Z",
- "endingDate": "2019-08-24T14:15:22Z",
- "completedAt": "2019-08-24T14:15:22Z",
- "applications": [
- {
- "id": 1,
- "applicationId": 1,
- "status": "NOT_STARTED"
}
]
}