> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Employee access insights

> Export the access review insights and recommendations Oleria computes for every employee and application, without launching an access review campaign.

Access review campaigns show reviewers a recommendation for each access grant, backed by usage and HR signals. The `employeeAccessInsights` download context exports that same underlying data as a CSV for every employee and application in your workspace - without creating a campaign, assigning reviewers, or waiting for a review cycle to close.

This export is read-only. Requesting it does not create a campaign, notify employees or reviewers, or change any access.

## When to use this export

* **Scope a campaign before you launch it.** See how many grants would come back with a low-confidence recommendation, and which applications drive that count, so you can scope reviewers onto the access that actually needs a human decision.
* **Audit access outside a review cycle.** Pull point-in-time evidence about who holds access to what and how they use it, on your own schedule.
* **Analyze insights in your own tools.** Load the CSV into a warehouse, BI tool, or spreadsheet and segment by department, manager, or application.
* **Validate the signals against what you already know.** Compare a signal to ground truth you hold today before you rely on it in a live campaign.
* **Integrate with your own access review workflow.** Use the same signals and recommendations Oleria uses in its campaigns, but in your own system.

## What each row represents

Each row is one employee's access to one application, along with the insight signals Oleria computed for that pairing and the resulting recommendation.

Columns are grouped by prefix:

| Prefix             | What it describes                                                                          |
| :----------------- | :----------------------------------------------------------------------------------------- |
| `subject_`         | The employee, their HR record, and the identity provider account that holds the access.    |
| `object_`          | The application the employee has access to.                                                |
| `hr_change_`       | Recent changes to the employee's HR record, and the rating derived from them.              |
| `dormant_days_`    | How long the identity has gone without recorded activity, and the rating derived from it.  |
| `login_frequency_` | How often the identity signed in, and the rating derived from it.                          |
| `peer_group_`      | How common this application is among the employee's peers, and the rating derived from it. |
| `recommendation`   | The overall rating that rolls up the four signals.                                         |

## Request the export

The `employeeAccessInsights` context uses the standard asynchronous download flow. See [Working with Downloads](/developer-docs/api-reference/working-with-downloads) for the full lifecycle, and the [`filterBy` schema](/api-reference/downloads/create-a-download-request) for the operators valid on each column type.

<Steps>
  <Step title="Get an access token">
    The API uses the OAuth 2.0 Client Credentials grant. Exchange your `client_id` and `client_secret` for a short-lived token, then send it as a `Bearer` credential on every request. See [API Overview](/developer-docs/api-reference/overview) for authentication and for the base URL that replaces `YOUR_TENANT` below.
  </Step>

  <Step title="Create the download request">
    `POST /v1/downloads` with `context` set to `employeeAccessInsights`. You get back a `DownloadRequest` with a UUID `id` and `status: "accepted"`.

    <CodeGroup>
      ```bash cURL theme={null}
      curl -X POST https://devx.YOUR_TENANT.oleria.io/v1/downloads \
        -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{ "context": "employeeAccessInsights" }'
      ```

      ```python Python theme={null}
      import requests

      resp = requests.post(
          "https://devx.YOUR_TENANT.oleria.io/v1/downloads",
          headers={
              "Authorization": f"Bearer {access_token}",
              "Content-Type": "application/json",
          },
          json={"context": "employeeAccessInsights"},
      )
      request_id = resp.json()["id"]
      ```

      ```javascript Node.js theme={null}
      const resp = await fetch("https://devx.YOUR_TENANT.oleria.io/v1/downloads", {
        method: "POST",
        headers: {
          Authorization: `Bearer ${accessToken}`,
          "Content-Type": "application/json",
        },
        body: JSON.stringify({ context: "employeeAccessInsights" }),
      });
      const { id: requestId } = await resp.json();
      ```

      ```go Go theme={null}
      body := strings.NewReader(`{"context": "employeeAccessInsights"}`)
      req, _ := http.NewRequest("POST", "https://devx.YOUR_TENANT.oleria.io/v1/downloads", body)
      req.Header.Set("Authorization", "Bearer "+accessToken)
      req.Header.Set("Content-Type", "application/json")
      resp, err := http.DefaultClient.Do(req)
      ```
    </CodeGroup>
  </Step>

  <Step title="Poll until it completes">
    `GET /v1/downloads/{id}` until `status` is `completed` and the response carries a presigned `url`. Back off between polls - a full-workspace export covers every employee and application pairing, so it can take longer than a narrowly filtered one.
  </Step>

  <Step title="Fetch the CSV">
    `GET` the presigned `url` directly. No Oleria authentication is required on the presigned URL. It expires after 5 minutes by default; set `downloadUrlTtlMinutes` on the create request if your pipeline needs longer.
  </Step>
</Steps>

<Note>
  Set `fileFormat` to `jsonl` on the create request if you would rather load newline-delimited JSON than CSV. The columns are identical either way.
</Note>

## How to read the ratings

Every signal, and the overall recommendation, uses the same scale:

| Rating        | Meaning                                                                                 |
| :------------ | :-------------------------------------------------------------------------------------- |
| `HIGH`        | High confidence the account should keep its existing access.                            |
| `MEDIUM`      | Mixed evidence. Worth a reviewer's attention.                                           |
| `LOW`         | Low confidence the access should be kept. The strongest candidate for revocation.       |
| `UNAVAILABLE` | Oleria does not have enough data to rate this signal. The paired value column is blank. |

<Warning>
  A rating always describes confidence in keeping the access, never the size of the underlying number. A `dormant_days_rating` of `HIGH` means the identity was active recently, not that it has been dormant a long time.
</Warning>

### The four signals

| Signal          | Columns             | What it measures                                                                                  | What raises the rating                                                                                                      |
| :-------------- | :------------------ | :------------------------------------------------------------------------------------------------ | :-------------------------------------------------------------------------------------------------------------------------- |
| HR change       | `hr_change_*`       | Whether the employee's department, job title, or manager changed recently.                        | No recent change. A change lowers the rating, because access granted for a previous role may no longer fit the current one. |
| Dormancy        | `dormant_days_*`    | Days since the identity last showed recorded activity, measured across a 90-day activity window.  | Recent activity. Long dormancy lowers the rating.                                                                           |
| Login frequency | `login_frequency_*` | Number of logins recorded across the same 90-day window.                                          | More logins.                                                                                                                |
| Peer group      | `peer_group_*`      | The share of the employee's peers who also have access to this same application, from `0` to `1`. | A larger share of peers holding the same access. Access that almost no peer holds lowers the rating.                        |

Oleria rolls these four signals into the single `recommendation` column. That value is the same recommendation reviewers see in an access review campaign, so a grant that reads `LOW` here would arrive in a reviewer's queue flagged as low confidence.

### How peer groups are defined

The peer group signal asks how unusual this access is among comparable employees, not how much the employee uses it. An application that every peer holds looks like standard access for the role. An application only this employee holds is an outlier worth a reviewer's attention, however actively it is used.

The peer group is a workspace-level setting. Go to **Governance** -> **Access Reviews** -> **Settings** -> **Peer Group** and choose one of:

* **Department**
* **Job Title**
* **First-level Manager**
* **Second-level Manager**

Changing this setting changes `peer_group_percentile` and `peer_group_rating` in later exports. If you compare two exports taken at different times, confirm the setting matched for both.

## Column reference

### Employee and identity

The employee's HR record and the identity provider account that holds the access. The two can disagree - `subject_email` comes from the HR system, `subject_identity_email` from the identity provider.

| Column                                    | Description                                                                                                    |
| :---------------------------------------- | :------------------------------------------------------------------------------------------------------------- |
| `subject_name`                            | Employee display name from the HR system.                                                                      |
| `subject_email`                           | Employee email from the HR system.                                                                             |
| `subject_employee_id`                     | Employee identifier in the HR system.                                                                          |
| `subject_employee_number`                 | Employee number in the HR system.                                                                              |
| `subject_employee_oleria_global_id`       | Oleria global identifier for the employee record.                                                              |
| `subject_employee_job_function`           | Employee job title or function from the HR system.                                                             |
| `subject_employee_manager_name`           | Name of the employee's manager.                                                                                |
| `subject_employee_start_date`             | Employee start date.                                                                                           |
| `subject_department_name`                 | Department name from the HR system.                                                                            |
| `subject_department_id`                   | Oleria global identifier for the department.                                                                   |
| `subject_department_company_code`         | Company or organizational code for the department, as supplied by the HR system.                               |
| `subject_identity_name`                   | Display name on the identity provider account.                                                                 |
| `subject_identity_email`                  | Email on the identity provider account.                                                                        |
| `subject_identity_oleria_global_id`       | Oleria global identifier for the identity.                                                                     |
| `subject_identity_created_date`           | When the identity provider account was created.                                                                |
| `subject_identity_current_account_status` | `ENABLED` or `DISABLED`.                                                                                       |
| `subject_identity_is_enabled`             | Boolean form of `subject_identity_current_account_status`.                                                     |
| `subject_identity_application_role`       | The role the account holds in the identity provider, for example `Member`, `Guest`, or `Global Administrator`. |
| `subject_idp_application_name`            | The identity provider, for example `Okta` or `MicrosoftEntraId`.                                               |
| `subject_idp_application_instance_name`   | The connected instance of that identity provider.                                                              |
| `subject_idp_application_id`              | Oleria identifier for the identity provider instance.                                                          |

### Application

The application the employee has access to.

| Column                              | Description                                                                                                                                                |
| :---------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `object_name`                       | Application name.                                                                                                                                          |
| `object_source_id`                  | The application's identifier in the source system.                                                                                                         |
| `object_oleria_global_id`           | Oleria global identifier for the application.                                                                                                              |
| `object_application_type`           | Oleria application type when the application maps to a recognized type, for example `Salesforce` or `GCP`. Blank for applications with no recognized type. |
| `object_type`                       | Classification of the access target.                                                                                                                       |
| `object_subtype`                    | Finer-grained classification of the access target.                                                                                                         |
| `object_description`                | Application description from the source system.                                                                                                            |
| `object_data_classification_labels` | Data classification labels applied to the application.                                                                                                     |
| `object_idp_application_id`         | Identifier of the identity provider instance the access is granted through.                                                                                |

### HR change signal

The `old` and `new` columns are populated only for the attribute that changed. If `hr_change_job_title_change` is `false`, `hr_change_old_job_title` and `hr_change_new_job_title` are blank.

| Column                        | Description                                                                  |
| :---------------------------- | :--------------------------------------------------------------------------- |
| `hr_change_department_change` | `true` if the employee's department changed recently.                        |
| `hr_change_job_title_change`  | `true` if the employee's job title changed recently.                         |
| `hr_change_manager_change`    | `true` if the employee's manager changed recently.                           |
| `hr_change_old_department`    | Department before the change.                                                |
| `hr_change_new_department`    | Department after the change.                                                 |
| `hr_change_old_job_title`     | Job title before the change.                                                 |
| `hr_change_new_job_title`     | Job title after the change.                                                  |
| `hr_change_old_manager`       | Manager before the change.                                                   |
| `hr_change_new_manager`       | Manager after the change.                                                    |
| `hr_change_rating`            | `HIGH` when nothing changed. Lower when the employee's role context shifted. |

### Dormancy signal

| Column                            | Description                                                                                                          |
| :-------------------------------- | :------------------------------------------------------------------------------------------------------------------- |
| `dormant_days_value`              | Days without recorded activity, capped at the 90-day activity window.                                                |
| `dormant_days_last_activity_date` | Timestamp of the last recorded activity. Populated only when `dormant_days_source_property` is `LAST_ACTIVITY_DATE`. |
| `dormant_days_source_property`    | What `dormant_days_value` was measured from. See the table below.                                                    |
| `dormant_days_rating`             | `HIGH` for recent activity, `LOW` for long dormancy.                                                                 |

| `dormant_days_source_property`  | Meaning                                                                                                                                               |
| :------------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
| `LAST_ACTIVITY_DATE`            | Measured from real recorded activity. This is an exact figure.                                                                                        |
| `AT_LEAST_ACTIVITY_WINDOW_DAYS` | No activity anywhere in the window. Dormancy is at least `dormant_days_value` days, and may be longer than Oleria can see.                            |
| `CREATION_DATE`                 | Measured from the account creation date because no activity was ever recorded. The account was created inside the window and has not been used since. |

<Note>
  `AT_LEAST_ACTIVITY_WINDOW_DAYS` is a floor, not an exact count. For the equivalent figure in the Oleria interface, see [Dormancy thresholds](/governance/account-dormant-days), where the same case is displayed with a `+` suffix.
</Note>

### Login frequency signal

| Column                   | Description                                                                                                              |
| :----------------------- | :----------------------------------------------------------------------------------------------------------------------- |
| `login_frequency_value`  | Logins recorded across the 90-day activity window. Blank when the rating is `UNAVAILABLE`.                               |
| `login_frequency_rating` | `HIGH` for frequent logins, `LOW` for few or none. `UNAVAILABLE` when Oleria has no login telemetry for the application. |

### Peer group signal

| Column                  | Description                                                                                                                                                                                      |
| :---------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `peer_group_percentile` | The share of the employee's peer group that also has access to this application, from `0` to `1`. A value of `1` means every peer holds the same access. Blank when the rating is `UNAVAILABLE`. |
| `peer_group_rating`     | `HIGH` when most or all peers hold the same access, `LOW` when few do. `UNAVAILABLE` when the peer group cannot be determined or is too small to compare against.                                |

### Recommendation

| Column           | Description                                                                                                            |
| :--------------- | :--------------------------------------------------------------------------------------------------------------------- |
| `recommendation` | The overall rating rolling up all four signals. This is the recommendation reviewers see in an access review campaign. |

<Note>
  Any column can be blank when the underlying data is not available or does not apply to that row. A blank rating column is written as `UNAVAILABLE`; a blank value column is written as an empty string.
</Note>

## Contact us

For questions about this export, contact us at [support@oleria.com](mailto:support@oleria.com).