Skip to main content
After approval, Flow runs the configured automation and records an access grant. The connected application remains the source of the actual entitlement.

​
Following fulfillment

Open the related conversation to review its approval and automation run. Use Automations → Monitoring when the run is waiting or failed.

​
Duplicate software license requests

Flow checks for an existing license or unfinished access request before creating another request or asking for approval. If another request is in progress, check that request for updates. If access is being removed, contact your service team. If your existing access does not work, ask Flow to open a support ticket. Include the symptoms, impact, and fixes you tried. The service team receives an incident to investigate instead of another license request. Flow also checks before assigning access. If access changes while your request waits for approval, Flow posts a notice in the related conversation. In a private conversation, the notice says No additional license assigned, names the license, and explains what blocked the assignment. Shared Slack and Teams threads ask you to message Flow privately for details and next steps. The approval decision remains recorded. Retrying the same request preserves its original identity. An approved extension changes the existing grant’s expiry and does not consume another seat. After Flow records the grant as Revoked or Expired, a new request can allocate a seat if eligibility and capacity permit. Different people and distinct software licenses can have separate allocations. Historical grants remain in the access record.

​
Grant states

Common states are Pending provisioning, Active, Revoking, Revoked, Expired, and Failed. These states describe Flow’s access record. A Revoked or Expired record alone does not confirm that access was removed in the connected application.

​
Inspecting grants with the CLI

Use the Flow command-line interface (CLI) to list and inspect grants:
Without --team-id, you see your own grants. Organization administrators can list all grants in the organization. The --team-id option requires access-management permission for that team. Use --principal-id and --status to narrow your results. Personal reads show grant identity, status, and dates. Team and administrator reads also include provisioning and lifecycle evidence. Use JSON output to read pagination details:
When page.has_more is true, pass page.next_cursor to the next command. Keep the same filters and signed-in account. Treat the cursor as an opaque string. It expires after one hour. If Flow returns invalid_cursor, restart the list without a cursor:
Inspect one grant:
Use https://app.letsflow.ai/v1 as the API base URL.

​
Revoke a grant

Use this command to mark a grant and its assignments as revoked in Flow. It does not start an automation or remove access in the connected application. Before running the command:
  1. Remove the person’s access in the connected application, or use an automation configured to do it.
  2. Confirm in that application that the person no longer has the access.
  3. Record the removal in Flow with the command below.
You need access-management permission for the grant’s team.
Use flow access-grant get to confirm that Flow now shows Revoked. This confirms the record update only; it is not a second check of the connected application.