curl --request POST \
--url https://api.lumos.com/access_reviews \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"apps": [
{
"id": "00000000-0000-0000-0000-000000000001",
"review_type": "ENTITLEMENTS"
}
],
"deadline_at": "2026-06-30T23:59:59Z",
"name": "Q2 2026 Quarterly Access Review"
}
'import requests
url = "https://api.lumos.com/access_reviews"
payload = {
"apps": [
{
"id": "00000000-0000-0000-0000-000000000001",
"review_type": "ENTITLEMENTS"
}
],
"deadline_at": "2026-06-30T23:59:59Z",
"name": "Q2 2026 Quarterly Access Review"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
apps: [{id: '00000000-0000-0000-0000-000000000001', review_type: 'ENTITLEMENTS'}],
deadline_at: '2026-06-30T23:59:59Z',
name: 'Q2 2026 Quarterly Access Review'
})
};
fetch('https://api.lumos.com/access_reviews', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.lumos.com/access_reviews",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'apps' => [
[
'id' => '00000000-0000-0000-0000-000000000001',
'review_type' => 'ENTITLEMENTS'
]
],
'deadline_at' => '2026-06-30T23:59:59Z',
'name' => 'Q2 2026 Quarterly Access Review'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.lumos.com/access_reviews"
payload := strings.NewReader("{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.lumos.com/access_reviews")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.lumos.com/access_reviews")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}"
response = http.request(request)
puts response.read_body{
"access_review": {
"id": "<string>",
"name": "<string>",
"status": "IN_PREPARATION",
"creation_path": "UI",
"owner_id": "<string>",
"created_by_id": "<string>",
"deadline_at": "2023-11-07T05:31:56Z",
"started_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"target_launch_date": "2023-11-07T05:31:56Z",
"recurrence_config": {
"freq": 123,
"interval": 123,
"count": 123,
"until": "<string>",
"byweekday": [
123
],
"bymonth": [
123
],
"bymonthday": [
123
],
"byyearday": [
123
],
"byweekno": [
123
],
"bysetpos": [
123
],
"byhour": [
123
],
"byminute": [
123
],
"bysecond": [
123
],
"wkst": 123
},
"recurrence_days_frequency": 123,
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"apps": [
{
"id": "<string>",
"domain_app_id": "<string>",
"domain_app_name": "<string>",
"domain_app_sources": [
"<string>"
],
"status": "IN_PREPARATION",
"review_type": "ACCOUNTS",
"app_last_synced_at": "2023-11-07T05:31:56Z",
"last_synced_at": "2023-11-07T05:31:56Z",
"account_count": 123,
"launched_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"scope_filters": [
{}
]
}
]
},
"errors": [
{
"app_id": "<string>",
"error": "<string>"
}
]
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Create Access Review
Create a new access review campaign.
The review’s initial status depends on whether apps are provided:
- With apps: the review starts in
IN_PREPARATIONwhile account and entitlement snapshots are taken. Status automatically transitions toIN_PROGRESSonce snapshotting completes. - Without apps: the review is created directly in
IN_PROGRESS.
Poll GET /access_reviews/{id} to observe the status transition. To add apps after creation, use POST /access_reviews/{id}/apps (allowed on any status except COMPLETED).
curl --request POST \
--url https://api.lumos.com/access_reviews \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"apps": [
{
"id": "00000000-0000-0000-0000-000000000001",
"review_type": "ENTITLEMENTS"
}
],
"deadline_at": "2026-06-30T23:59:59Z",
"name": "Q2 2026 Quarterly Access Review"
}
'import requests
url = "https://api.lumos.com/access_reviews"
payload = {
"apps": [
{
"id": "00000000-0000-0000-0000-000000000001",
"review_type": "ENTITLEMENTS"
}
],
"deadline_at": "2026-06-30T23:59:59Z",
"name": "Q2 2026 Quarterly Access Review"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
apps: [{id: '00000000-0000-0000-0000-000000000001', review_type: 'ENTITLEMENTS'}],
deadline_at: '2026-06-30T23:59:59Z',
name: 'Q2 2026 Quarterly Access Review'
})
};
fetch('https://api.lumos.com/access_reviews', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.lumos.com/access_reviews",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'apps' => [
[
'id' => '00000000-0000-0000-0000-000000000001',
'review_type' => 'ENTITLEMENTS'
]
],
'deadline_at' => '2026-06-30T23:59:59Z',
'name' => 'Q2 2026 Quarterly Access Review'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.lumos.com/access_reviews"
payload := strings.NewReader("{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.lumos.com/access_reviews")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.lumos.com/access_reviews")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"apps\": [\n {\n \"id\": \"00000000-0000-0000-0000-000000000001\",\n \"review_type\": \"ENTITLEMENTS\"\n }\n ],\n \"deadline_at\": \"2026-06-30T23:59:59Z\",\n \"name\": \"Q2 2026 Quarterly Access Review\"\n}"
response = http.request(request)
puts response.read_body{
"access_review": {
"id": "<string>",
"name": "<string>",
"status": "IN_PREPARATION",
"creation_path": "UI",
"owner_id": "<string>",
"created_by_id": "<string>",
"deadline_at": "2023-11-07T05:31:56Z",
"started_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"target_launch_date": "2023-11-07T05:31:56Z",
"recurrence_config": {
"freq": 123,
"interval": 123,
"count": 123,
"until": "<string>",
"byweekday": [
123
],
"bymonth": [
123
],
"bymonthday": [
123
],
"byyearday": [
123
],
"byweekno": [
123
],
"bysetpos": [
123
],
"byhour": [
123
],
"byminute": [
123
],
"bysecond": [
123
],
"wkst": 123
},
"recurrence_days_frequency": 123,
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"apps": [
{
"id": "<string>",
"domain_app_id": "<string>",
"domain_app_name": "<string>",
"domain_app_sources": [
"<string>"
],
"status": "IN_PREPARATION",
"review_type": "ACCOUNTS",
"app_last_synced_at": "2023-11-07T05:31:56Z",
"last_synced_at": "2023-11-07T05:31:56Z",
"account_count": 123,
"launched_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"scope_filters": [
{}
]
}
]
},
"errors": [
{
"app_id": "<string>",
"error": "<string>"
}
]
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Name of the access review campaign.
1 - 255Deadline by which reviewers must complete their reviews. ISO 8601 datetime (e.g. '2026-05-01T00:00:00Z').
UUID of the user to set as the review owner. Defaults to the authenticated user if not provided.
Scheduled launch date for the review. ISO 8601 datetime.
Recurrence configuration. Mutually exclusive with recurrence_days_frequency.
Show child attributes
Show child attributes
Recurrence frequency in days. Mutually exclusive with recurrence_config.
List of domain apps to include in this review. Capped at 200 entries per the Access Review scale limits (technically-supported tier).
200Show child attributes
Show child attributes
Response
Successful Response