<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Access Review Processes — API Reference

## Okta Users API

```python
import requests

OKTA_URL = "https://corp.okta.com"
OKTA_TOKEN = "SSWS your-api-token"

# List users with search
resp = requests.get(f"{OKTA_URL}/api/v1/users", headers={
    "Authorization": OKTA_TOKEN,
}, params={"search": 'status eq "ACTIVE"', "limit": 200})

# Get user's groups/roles
resp = requests.get(f"{OKTA_URL}/api/v1/users/{user_id}/groups", headers={
    "Authorization": OKTA_TOKEN,
})

# Deactivate user
requests.post(f"{OKTA_URL}/api/v1/users/{user_id}/lifecycle/deactivate", headers={
    "Authorization": OKTA_TOKEN,
})
```

## AWS IAM API

```python
import boto3

iam = boto3.client("iam")

# List users
users = iam.list_users()

# Get last used for access key
resp = iam.get_access_key_last_used(AccessKeyId="AKIAXXXXXXXXXX")

# Get credential report
iam.generate_credential_report()
report = iam.get_credential_report()

# List attached user policies
iam.list_attached_user_policies(UserName="username")
```

## Azure AD Graph API

```python
import requests

GRAPH_URL = "https://graph.microsoft.com/v1.0"
TOKEN = "Bearer your-token"

# List users with sign-in activity
resp = requests.get(f"{GRAPH_URL}/users", headers={"Authorization": TOKEN},
    params={"$select": "displayName,signInActivity,accountEnabled"})

# List user's role assignments
resp = requests.get(f"{GRAPH_URL}/users/{user_id}/appRoleAssignments",
    headers={"Authorization": TOKEN})
```

## Access Review SLA

| Account Type | Review Frequency | Dormant Threshold |
|-------------|-----------------|-------------------|
| Admin/Privileged | Quarterly | 30 days |
| Service Account | Semi-annually | 90 days |
| Standard User | Annually | 90 days |
| Contractor | Monthly | 30 days |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Review completed — no issues |
| 1 | Review completed — findings detected |
| 2 | Review failed |
