> ## Documentation Index
> Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access reviews

> Review active grants and record keep, revoke, or defer decisions.

An access review campaign takes a snapshot of active grants for one team. The assigned reviewer can:

* **Approve** to keep a grant
* **Revoke** to mark the grant as revoked in Flow
* **Defer** to record no decision

<Note>Access reviews are currently managed with the Flow command-line interface (CLI).</Note>

## Create a campaign

```bash theme={null}
flow access-review campaign-create \
  --org-id <organization-uuid> \
  --team-id <team-uuid> \
  --name "Quarterly access review" \
  --created-by-principal-id <creator-principal-uuid> \
  --reviewer-principal-id <reviewer-principal-uuid> \
  --output json \
  --api-base-url <api-base-url>
```

Add `--principal-id <recipient-principal-uuid>` to review one person's grants. Use
`https://app.letsflow.ai/v1` as the API base URL.

The selected creator and reviewer identify their campaign roles. Flow also records the caller
who starts the campaign in the audit history, even when that caller differs from the
selected creator. Add `--idempotency-key <key>` to make the submission retryable. An unchanged
retry with the same key does not add another campaign or audit event.

The selected creator and reviewer identify their campaign roles. Flow also records the caller
who starts the campaign in the audit history, even when that caller differs from the
selected creator. Add `--idempotency-key <key>` to make the submission retryable. An unchanged
retry with the same key does not add another campaign or audit event.

<Warning>
  The current CLI does not list existing campaigns. Save the returned item IDs. You need the IDs to
  decide items and cannot retrieve them later.
</Warning>

## Decide an item

Before choosing **Revoke**, remove access in the connected application and confirm the result there.
The review decision updates Flow's records; it does not run a removal automation or change the
connected application. See [Revoke a grant](/setup/access-management/provisioning#revoke-a-grant).

```bash theme={null}
flow access-review decide <review-item-uuid> \
  --decision-kind approve \
  --reviewer-principal-id <reviewer-principal-uuid> \
  --reason "Access is still required" \
  --api-base-url <api-base-url>
```

Use `revoke` or `defer` for the other decisions. Only the assigned reviewer can decide an item, and
each item accepts one decision.

## Related topics

* [Access governance](/setup/access-management/overview)
* [Provisioning and grants](/setup/access-management/provisioning)
* [CLI](/setup/cli)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.