Skip to main content
Version: Latest (4.0.6)

Submit user access reviews (bulk)

POST 
/recertification/campaigns/:campaignID/reviews

Records one or more review decisions for users in the specified campaign.

Scope: cidaas:campaign_review. Management scopes (campaign_read, campaign_write) are not accepted. Authorisation is enforced by campaign assignment — caller must appear in groups[].reviewers for at least one group the subject belongs to.

Limits: 1–100 entries in reviews. Empty list → 417.

Atomicity: Not atomic. Each entry is processed independently; successful rows are persisted even when others fail. HTTP 207 Multi-Status when at least one entry failed; response body contains all per-entry results with individual status codes so callers can identify which subs need to be retried. HTTP 200 only when every entry succeeded.

Per-entry rules:

  • Campaign must be IN_PROGRESS and within timeframe.
  • Payload groups must belong to subject; reviewer must have campaign scope for the subject (listed on at least one campaign group the subject belongs to).
  • Exactly one review object per group; decision must be KEEP, REDUCE, or REVOKE.
  • reviewer in payload is overwritten with token sub; campaignId is stamped from path.
  • PARALLEL_ONE: once any reviewer has finalised the decision for a subject+group, all further submissions for that pair are rejected.
  • PARALLEL_ALL: once a reviewer has submitted for a subject+group they cannot resubmit, even before quorum is reached. The user cannot be re-reviewed once at COMPLETED status.
  • Self-review is allowed — a reviewer may review their own group access.

Strategy behavior: all groups — campaign and non-campaign alike — use the campaign strategy. For PARALLEL_ALL, quorum for every group uses the required reviewer set: the deduplicated union of reviewers from all campaign groups the subject belongs to.

Request​

Responses​

All entries succeeded