Sync App Review

curl --request POST \
  --url https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "scope_filters": [
    {
      "group": "EMPLOYMENT_STATUS",
      "label": "Inactive",
      "name": "Employment Status",
      "value": "INACTIVE"
    }
  ],
  "skip_new_data": true
}
'

import requests

url = "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync"

payload = {
    "scope_filters": [
        {
            "group": "EMPLOYMENT_STATUS",
            "label": "Inactive",
            "name": "Employment Status",
            "value": "INACTIVE"
        }
    ],
    "skip_new_data": True
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    scope_filters: [
      {
        group: 'EMPLOYMENT_STATUS',
        label: 'Inactive',
        name: 'Employment Status',
        value: 'INACTIVE'
      }
    ],
    skip_new_data: true
  })
};

fetch('https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'scope_filters' => [
        [
                'group' => 'EMPLOYMENT_STATUS',
                'label' => 'Inactive',
                'name' => 'Employment Status',
                'value' => 'INACTIVE'
        ]
    ],
    'skip_new_data' => true
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync"

	payload := strings.NewReader("{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}"

response = http.request(request)
puts response.read_body

{
  "operation": {
    "id": "<string>",
    "done": true,
    "result": {},
    "error": {
      "code": "<string>",
      "message": "<string>",
      "errors": [
        {
          "field": "<string>",
          "code": "<string>",
          "message": "<string>"
        }
      ]
    },
    "metadata": {}
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Access Reviews

Sync App Review

Run the sync for one app review, optionally replacing its scope filters in the same call.

The sync runs asynchronously: the request returns 202 Accepted with an operation. Poll GET /v1/operations/{id} until done is true.

Rebuilding the subject set is what re-scoping means. Reviewer assignments survive for subjects that survive; subjects that fall out of scope take their assignments with them. A caller that re-scopes after assigning should re-check how many subjects are still unassigned before launching.

Only an app review at or before assigning-reviewers can be synced — once the review has launched, reviewers hold decisions a sync would invalidate.

POST

access-reviews

{review_uuid}

apps

{app_review_uuid}

:sync

Sync App Review

curl --request POST \
  --url https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "scope_filters": [
    {
      "group": "EMPLOYMENT_STATUS",
      "label": "Inactive",
      "name": "Employment Status",
      "value": "INACTIVE"
    }
  ],
  "skip_new_data": true
}
'

import requests

url = "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync"

payload = {
    "scope_filters": [
        {
            "group": "EMPLOYMENT_STATUS",
            "label": "Inactive",
            "name": "Employment Status",
            "value": "INACTIVE"
        }
    ],
    "skip_new_data": True
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    scope_filters: [
      {
        group: 'EMPLOYMENT_STATUS',
        label: 'Inactive',
        name: 'Employment Status',
        value: 'INACTIVE'
      }
    ],
    skip_new_data: true
  })
};

fetch('https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'scope_filters' => [
        [
                'group' => 'EMPLOYMENT_STATUS',
                'label' => 'Inactive',
                'name' => 'Employment Status',
                'value' => 'INACTIVE'
        ]
    ],
    'skip_new_data' => true
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync"

	payload := strings.NewReader("{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-reviews/{review_uuid}/apps/{app_review_uuid}:sync")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"scope_filters\": [\n    {\n      \"group\": \"EMPLOYMENT_STATUS\",\n      \"label\": \"Inactive\",\n      \"name\": \"Employment Status\",\n      \"value\": \"INACTIVE\"\n    }\n  ],\n  \"skip_new_data\": true\n}"

response = http.request(request)
puts response.read_body

{
  "operation": {
    "id": "<string>",
    "done": true,
    "result": {},
    "error": {
      "code": "<string>",
      "message": "<string>",
      "errors": [
        {
          "field": "<string>",
          "code": "<string>",
          "message": "<string>"
        }
      ]
    },
    "metadata": {}
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

review_uuid

string

required

The access review's ID.

app_review_uuid

string

required

The app review's ID. An app review is one app within the access review that review_uuid names.

Body

application/json

scope_filters

(ScalarScopeFilterInput · object | CustomAttributeScopeFilterInput · object | DatetimeScopeFilterInput · object)[] | null

Replaces the app review's scope filters wholesale — this is a PUT, not a merge, so send the full set you want and omit the field entirely to sync against the filters already set. An empty list clears them. Each filter's value must be one that GET /access_reviews/scope_options advertises for this app.

Scope filter for groups whose value is a simple string/UUID/enum.

Datetime-valued groups (LAST_LOGIN, LAST_ACTIVITY) use :class:DatetimeScopeFilterInput; CUSTOM_ATTRIBUTE uses :class:CustomAttributeScopeFilterInput.

ScalarScopeFilterInput
CustomAttributeScopeFilterInput
DatetimeScopeFilterInput

Show child attributes

skip_new_data

boolean

default:false

When true, rebuilds the subject set from data already synced instead of pulling fresh data from the integration — the fast path when only the filters changed.

Response

Successful Response

202 response body for endpoints that launch an operation.

operation

OperationOutput · object

required

The launched operation.

Show child attributes

Quick Start

Lumos API

API Reference

Guides

Migrate from v0

Lumos Connectors

Webhooks

Tools

Sync App Review

Authorizations

Path Parameters

Body

Response