> ## Documentation Index
> Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Provisioning and grants

> Follow access fulfillment and manage the resulting grant.

After approval, Flow runs the configured automation and records an access grant. The connected
application remains the source of the actual entitlement.

## Following fulfillment

Open the related conversation to review its approval and automation run. Use
**Automations → Monitoring** when the run is waiting or failed.

## Duplicate software license requests

Flow checks for an existing license or unfinished access request before creating another request
or asking for approval. If another request is in progress, check that request for updates. If access
is being removed, contact your service team.

If your existing access does not work, ask Flow to open a support ticket. Include the symptoms,
impact, and fixes you tried. The service team receives an incident to investigate instead of another
license request.

Flow also checks before assigning access. If access changes while your request waits for approval,
Flow posts a notice in the related conversation. In a private conversation, the notice says
**No additional license assigned**, names the license, and explains what blocked the assignment.
Shared Slack and Teams threads ask you to message Flow privately for details and next steps.
The approval decision remains recorded.

Retrying the same request preserves its original identity. An approved extension changes the
existing grant's expiry and does not consume another seat. After Flow records the grant as
**Revoked** or **Expired**, a new request can allocate a seat if eligibility and capacity permit.

Different people and distinct software licenses can have separate allocations. Historical grants
remain in the access record.

## Grant states

Common states are **Pending provisioning**, **Active**, **Revoking**, **Revoked**, **Expired**, and
**Failed**. These states describe Flow's access record. A **Revoked** or **Expired** record alone
does not confirm that access was removed in the connected application.

## Inspecting grants with the CLI

Use the Flow command-line interface (CLI) to list and inspect grants:

```bash theme={null}
flow access-grant list \
  --team-id <team-uuid> \
  --api-base-url <api-base-url>
```

Without `--team-id`, you see your own grants. Organization administrators can list all grants in the organization.
The `--team-id` option requires access-management permission for that team. Use `--principal-id` and `--status` to narrow your results.
Personal reads show grant identity, status, and dates. Team and administrator reads also include provisioning and lifecycle evidence.

Use JSON output to read pagination details:

```bash theme={null}
flow access-grant list --limit 20 --output json
```

When `page.has_more` is `true`, pass `page.next_cursor` to the next command. Keep the same filters and signed-in account. Treat the cursor as an opaque string. It expires after one hour. If Flow returns `invalid_cursor`, restart the list without a cursor:

```bash theme={null}
flow access-grant list --limit 20 --output json --cursor "<next-cursor>"
```

Inspect one grant:

```bash theme={null}
flow access-grant get <grant-uuid> \
  --api-base-url <api-base-url>
```

Use `https://app.letsflow.ai/v1` as the API base URL.

## Revoke a grant

Use this command to mark a grant and its assignments as revoked in Flow. It does not start an
automation or remove access in the connected application.

Before running the command:

1. Remove the person's access in the connected application, or use an automation configured to do it.
2. Confirm in that application that the person no longer has the access.
3. Record the removal in Flow with the command below.

You need access-management permission for the grant's team.

```bash theme={null}
flow access-grant revoke <grant-uuid> \
  --requested-by-principal-id <principal-uuid> \
  --reason "Role changed" \
  --api-base-url <api-base-url>
```

Use `flow access-grant get` to confirm that Flow now shows **Revoked**. This confirms the record
update only; it is not a second check of the connected application.

## Related topics

* [Access management overview](/setup/access-management/overview)
* [Access reviews](/setup/access-management/access-reviews)
* [CLI](/setup/cli)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.