Employee access insights

Access review campaigns show reviewers a recommendation for each access grant, backed by usage and HR signals. The employeeAccessInsights download context exports that same underlying data as a CSV for every employee and application in your workspace - without creating a campaign, assigning reviewers, or waiting for a review cycle to close. This export is read-only. Requesting it does not create a campaign, notify employees or reviewers, or change any access.

When to use this export

Scope a campaign before you launch it. See how many grants would come back with a low-confidence recommendation, and which applications drive that count, so you can scope reviewers onto the access that actually needs a human decision.
Audit access outside a review cycle. Pull point-in-time evidence about who holds access to what and how they use it, on your own schedule.
Analyze insights in your own tools. Load the CSV into a warehouse, BI tool, or spreadsheet and segment by department, manager, or application.
Validate the signals against what you already know. Compare a signal to ground truth you hold today before you rely on it in a live campaign.
Integrate with your own access review workflow. Use the same signals and recommendations Oleria uses in its campaigns, but in your own system.

What each row represents

Each row is one employee’s access to one application, along with the insight signals Oleria computed for that pairing and the resulting recommendation. Columns are grouped by prefix:

Prefix	What it describes
`subject_`	The employee, their HR record, and the identity provider account that holds the access.
`object_`	The application the employee has access to.
`hr_change_`	Recent changes to the employee’s HR record, and the rating derived from them.
`dormant_days_`	How long the identity has gone without recorded activity, and the rating derived from it.
`login_frequency_`	How often the identity signed in, and the rating derived from it.
`peer_group_`	How common this application is among the employee’s peers, and the rating derived from it.
`recommendation`	The overall rating that rolls up the four signals.

Request the export

The employeeAccessInsights context uses the standard asynchronous download flow. See Working with Downloads for the full lifecycle, and the filterBy schema for the operators valid on each column type.

Get an access token

The API uses the OAuth 2.0 Client Credentials grant. Exchange your client_id and client_secret for a short-lived token, then send it as a Bearer credential on every request. See API Overview for authentication and for the base URL that replaces YOUR_TENANT below.

Create the download request

POST /v1/downloads with context set to employeeAccessInsights. You get back a DownloadRequest with a UUID id and status: "accepted".

curl -X POST https://devx.YOUR_TENANT.oleria.io/v1/downloads \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "context": "employeeAccessInsights" }'

import requests

resp = requests.post(
    "https://devx.YOUR_TENANT.oleria.io/v1/downloads",
    headers={
        "Authorization": f"Bearer {access_token}",
        "Content-Type": "application/json",
    },
    json={"context": "employeeAccessInsights"},
)
request_id = resp.json()["id"]

const resp = await fetch("https://devx.YOUR_TENANT.oleria.io/v1/downloads", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${accessToken}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ context: "employeeAccessInsights" }),
});
const { id: requestId } = await resp.json();

body := strings.NewReader(`{"context": "employeeAccessInsights"}`)
req, _ := http.NewRequest("POST", "https://devx.YOUR_TENANT.oleria.io/v1/downloads", body)
req.Header.Set("Authorization", "Bearer "+accessToken)
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)

Poll until it completes

GET /v1/downloads/{id} until status is completed and the response carries a presigned url. Back off between polls - a full-workspace export covers every employee and application pairing, so it can take longer than a narrowly filtered one.

Fetch the CSV

GET the presigned url directly. No Oleria authentication is required on the presigned URL. It expires after 5 minutes by default; set downloadUrlTtlMinutes on the create request if your pipeline needs longer.

Set fileFormat to jsonl on the create request if you would rather load newline-delimited JSON than CSV. The columns are identical either way.

How to read the ratings

Every signal, and the overall recommendation, uses the same scale:

Rating	Meaning
`HIGH`	High confidence the account should keep its existing access.
`MEDIUM`	Mixed evidence. Worth a reviewer’s attention.
`LOW`	Low confidence the access should be kept. The strongest candidate for revocation.
`UNAVAILABLE`	Oleria does not have enough data to rate this signal. The paired value column is blank.

A rating always describes confidence in keeping the access, never the size of the underlying number. A dormant_days_rating of HIGH means the identity was active recently, not that it has been dormant a long time.

The four signals

Signal	Columns	What it measures	What raises the rating
HR change	`hr_change_*`	Whether the employee’s department, job title, or manager changed recently.	No recent change. A change lowers the rating, because access granted for a previous role may no longer fit the current one.
Dormancy	`dormant_days_*`	Days since the identity last showed recorded activity, measured across a 90-day activity window.	Recent activity. Long dormancy lowers the rating.
Login frequency	`login_frequency_*`	Number of logins recorded across the same 90-day window.	More logins.
Peer group	`peer_group_*`	The share of the employee’s peers who also have access to this same application, from `0` to `1`.	A larger share of peers holding the same access. Access that almost no peer holds lowers the rating.

Oleria rolls these four signals into the single recommendation column. That value is the same recommendation reviewers see in an access review campaign, so a grant that reads LOW here would arrive in a reviewer’s queue flagged as low confidence.

How peer groups are defined

The peer group signal asks how unusual this access is among comparable employees, not how much the employee uses it. An application that every peer holds looks like standard access for the role. An application only this employee holds is an outlier worth a reviewer’s attention, however actively it is used. The peer group is a workspace-level setting. Go to Governance -> Access Reviews -> Settings -> Peer Group and choose one of:

Department
Job Title
First-level Manager
Second-level Manager

Changing this setting changes peer_group_percentile and peer_group_rating in later exports. If you compare two exports taken at different times, confirm the setting matched for both.

Column reference

Employee and identity

The employee’s HR record and the identity provider account that holds the access. The two can disagree - subject_email comes from the HR system, subject_identity_email from the identity provider.

Column	Description
`subject_name`	Employee display name from the HR system.
`subject_email`	Employee email from the HR system.
`subject_employee_id`	Employee identifier in the HR system.
`subject_employee_number`	Employee number in the HR system.
`subject_employee_oleria_global_id`	Oleria global identifier for the employee record.
`subject_employee_job_function`	Employee job title or function from the HR system.
`subject_employee_manager_name`	Name of the employee’s manager.
`subject_employee_start_date`	Employee start date.
`subject_department_name`	Department name from the HR system.
`subject_department_id`	Oleria global identifier for the department.
`subject_department_company_code`	Company or organizational code for the department, as supplied by the HR system.
`subject_identity_name`	Display name on the identity provider account.
`subject_identity_email`	Email on the identity provider account.
`subject_identity_oleria_global_id`	Oleria global identifier for the identity.
`subject_identity_created_date`	When the identity provider account was created.
`subject_identity_current_account_status`	`ENABLED` or `DISABLED`.
`subject_identity_is_enabled`	Boolean form of `subject_identity_current_account_status`.
`subject_identity_application_role`	The role the account holds in the identity provider, for example `Member`, `Guest`, or `Global Administrator`.
`subject_idp_application_name`	The identity provider, for example `Okta` or `MicrosoftEntraId`.
`subject_idp_application_instance_name`	The connected instance of that identity provider.
`subject_idp_application_id`	Oleria identifier for the identity provider instance.

Application

The application the employee has access to.

Column	Description
`object_name`	Application name.
`object_source_id`	The application’s identifier in the source system.
`object_oleria_global_id`	Oleria global identifier for the application.
`object_application_type`	Oleria application type when the application maps to a recognized type, for example `Salesforce` or `GCP`. Blank for applications with no recognized type.
`object_type`	Classification of the access target.
`object_subtype`	Finer-grained classification of the access target.
`object_description`	Application description from the source system.
`object_data_classification_labels`	Data classification labels applied to the application.
`object_idp_application_id`	Identifier of the identity provider instance the access is granted through.

HR change signal

The old and new columns are populated only for the attribute that changed. If hr_change_job_title_change is false, hr_change_old_job_title and hr_change_new_job_title are blank.

Column	Description
`hr_change_department_change`	`true` if the employee’s department changed recently.
`hr_change_job_title_change`	`true` if the employee’s job title changed recently.
`hr_change_manager_change`	`true` if the employee’s manager changed recently.
`hr_change_old_department`	Department before the change.
`hr_change_new_department`	Department after the change.
`hr_change_old_job_title`	Job title before the change.
`hr_change_new_job_title`	Job title after the change.
`hr_change_old_manager`	Manager before the change.
`hr_change_new_manager`	Manager after the change.
`hr_change_rating`	`HIGH` when nothing changed. Lower when the employee’s role context shifted.

Dormancy signal

Column	Description
`dormant_days_value`	Days without recorded activity, capped at the 90-day activity window.
`dormant_days_last_activity_date`	Timestamp of the last recorded activity. Populated only when `dormant_days_source_property` is `LAST_ACTIVITY_DATE`.
`dormant_days_source_property`	What `dormant_days_value` was measured from. See the table below.
`dormant_days_rating`	`HIGH` for recent activity, `LOW` for long dormancy.

`dormant_days_source_property`	Meaning
`LAST_ACTIVITY_DATE`	Measured from real recorded activity. This is an exact figure.
`AT_LEAST_ACTIVITY_WINDOW_DAYS`	No activity anywhere in the window. Dormancy is at least `dormant_days_value` days, and may be longer than Oleria can see.
`CREATION_DATE`	Measured from the account creation date because no activity was ever recorded. The account was created inside the window and has not been used since.

AT_LEAST_ACTIVITY_WINDOW_DAYS is a floor, not an exact count. For the equivalent figure in the Oleria interface, see Dormancy thresholds, where the same case is displayed with a + suffix.

Column	Description
`login_frequency_value`	Logins recorded across the 90-day activity window. Blank when the rating is `UNAVAILABLE`.
`login_frequency_rating`	`HIGH` for frequent logins, `LOW` for few or none. `UNAVAILABLE` when Oleria has no login telemetry for the application.

Peer group signal

Column	Description
`peer_group_percentile`	The share of the employee’s peer group that also has access to this application, from `0` to `1`. A value of `1` means every peer holds the same access. Blank when the rating is `UNAVAILABLE`.
`peer_group_rating`	`HIGH` when most or all peers hold the same access, `LOW` when few do. `UNAVAILABLE` when the peer group cannot be determined or is too small to compare against.

Recommendation

Column	Description
`recommendation`	The overall rating rolling up all four signals. This is the recommendation reviewers see in an access review campaign.

Any column can be blank when the underlying data is not available or does not apply to that row. A blank rating column is written as UNAVAILABLE; a blank value column is written as an empty string.

Contact us

For questions about this export, contact us at support@oleria.com.

Getting Started

Posture

Governance

Administration

Support

When to use this export

What each row represents

Request the export

How to read the ratings

The four signals

How peer groups are defined

Column reference

Employee and identity

Application

HR change signal

Dormancy signal

Peer group signal

Recommendation

Contact us

​When to use this export

​What each row represents

​Request the export

​How to read the ratings

​The four signals

​How peer groups are defined

​Column reference

​Employee and identity

​Application

​HR change signal

​Dormancy signal

​Login frequency signal

​Peer group signal

​Recommendation

​Contact us

When to use this export

What each row represents

Request the export

How to read the ratings

The four signals

How peer groups are defined

Column reference

Employee and identity

Application

HR change signal

Dormancy signal

Login frequency signal

Peer group signal

Recommendation

Contact us