Skip to content
KataraKatara documentation

Read the frozen entries a review is answering

GET
/katara/v1/orgs/{org_id}/environments/{environment_id}/access-reviews/{id}/items
curl --request GET \
  --url 'https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access-reviews/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/items?limit=100' \
  --cookie katara_session=<katara_session>

Requires current locus:audit:read permission and an owner or administrator signed in as a person; API keys, service identities and workloads are refused, because a review nobody is accountable for is a form. Reviews cover organization membership, service identities, team seats, keys and grants for this environment. Recording a decision to remove access does not remove it: a worker revoking a customer’s access on a schedule would be a worse problem than the one a review solves, so the review refuses to close while what it named still holds access.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Query Parameters

Section titled “Query Parameters”
after
integer
<= 5000
limit
integer
default: 100 >= 1 <= 100

Responses

Section titled “Responses”

200

Section titled “200”

Read the frozen entries a review is answering.

Media typeapplication/json
object
data
required
Array<object>
<= 100 items

What one subject held when the review opened. The detail is what somebody needs to judge it and never anything that could be used: a key’s scopes, never its secret.

object
ordinal
required
integer
>= 1 <= 5000
subject_kind
required
Allowed values: member service_account key grant team_member
subject_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
principal_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
detail
required
object
integrity
required
string
/^sha256:[a-f0-9]{64}$/
decision
Allowed values: keep remove
Example
{
  "data": [
    {
      "subject_kind": "member",
      "decision": "keep"
    }
  ]
}

default

Section titled “default”

Request rejected or unavailable.

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}