Skip to main content
An access review campaign takes a snapshot of active grants for one team. The assigned reviewer can:
  • Approve to keep a grant
  • Revoke to mark the grant as revoked in Flow
  • Defer to record no decision
Access reviews are currently managed with the Flow command-line interface (CLI).

​
Create a campaign

Add --principal-id <recipient-principal-uuid> to review one person’s grants. Use https://app.letsflow.ai/v1 as the API base URL. The selected creator and reviewer identify their campaign roles. Flow also records the caller who starts the campaign in the audit history, even when that caller differs from the selected creator. Add --idempotency-key <key> to make the submission retryable. An unchanged retry with the same key does not add another campaign or audit event. The selected creator and reviewer identify their campaign roles. Flow also records the caller who starts the campaign in the audit history, even when that caller differs from the selected creator. Add --idempotency-key <key> to make the submission retryable. An unchanged retry with the same key does not add another campaign or audit event.
The current CLI does not list existing campaigns. Save the returned item IDs. You need the IDs to decide items and cannot retrieve them later.

​
Decide an item

Before choosing Revoke, remove access in the connected application and confirm the result there. The review decision updates Flow’s records; it does not run a removal automation or change the connected application. See Revoke a grant.
Use revoke or defer for the other decisions. Only the assigned reviewer can decide an item, and each item accepts one decision.