<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Identity Governance — API Reference

## Azure AD Access Reviews (Microsoft Graph)

```bash
# List access review definitions
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" \
  | jq '.value[] | {id, displayName, status, scope}'

# Get review instance decisions
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/DEF_ID/instances/INST_ID/decisions" \
  | jq '.value[] | {principal, decision, justification, reviewedDateTime}'

# Create access review
curl -s -X POST -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" \
  -d @review-definition.json
```

## Entitlement Management

```bash
# List access packages
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages" \
  | jq '.value[] | {id, displayName, catalogId}'

# List access package assignments
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignments?\
\$filter=state eq 'Delivered'" | jq '.value[] | {target, accessPackage, schedule}'
```

## Lifecycle Workflows

```bash
# List lifecycle workflows
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/lifecycleWorkflows/workflows" \
  | jq '.value[] | {id, displayName, category, isEnabled}'

# Get workflow execution history
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityGovernance/lifecycleWorkflows/workflows/WF_ID/runs" \
  | jq '.value[] | {completedDateTime, processingStatus, totalTasksCount, failedTasksCount}'
```

## Key Metrics

| Metric | Target | Alert |
|--------|--------|-------|
| Access review completion rate | > 95% | < 80% |
| Orphaned accounts | 0 | > 5 |
| SoD violations | 0 | Any |
| Time to deprovision (leaver) | < 24 hours | > 72 hours |
| Access package approval time | < 4 hours | > 24 hours |
