---
title: "List account access records for an audit"
method: GET
path: "/audits/{auditId}/personnel/account-access/{serviceId}"
tags: ["Audits"]
---

# List account access records for an audit

`GET /audits/{auditId}/personnel/account-access/{serviceId}`

Retrieves account access population data for an audit.

This endpoint provides access to account access records visible to auditors
during an audit engagement. Account access data comes from various sources:

- **IDP Services** (Identity Providers): Okta, Azure AD, Google Workspace, OneLogin, PingOne

  - Returns user accounts from identity providers
  - Supports filtering by search and status

- **Role Grants Services**: GCP, Azure (when role grants are enabled)

  - Returns accounts with role-based access grants
  - Supports filtering by search and status

- **First-Party Account Services**: AWS, Oracle Cloud, Azure (when not using role grants), etc.

  - Returns cloud provider account access records
  - Supports filtering by search and status

- **Received Account Services**: External applications (Jira, GitHub, Slack, etc.)

  - Returns user accounts from third-party integrations
  - Supports filtering by search and status


Supports filtering by:
- `search`: Searches account names/emails (case-insensitive)
- `status`: Filters by account status

Uses cursor-based pagination. To paginate:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage`
3. Use `results.pageInfo.endCursor` as `pageCursor` for next request

The default sort order depends on the service type:
- Identity provider services (e.g. Okta, Azure AD): sorted by email, ascending
- Cloud provider services (e.g. AWS, GCP): sorted by account name, ascending
- Role grant services: sorted by account name, ascending
- Third-party application services (e.g. GitHub, Jira): sorted by account name, ascending

Sort order cannot be customized via query parameters.

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required
- `serviceId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `search` string
- `status` 'ACTIVE' | 'DEACTIVATED' | 'UNKNOWN' — Account status values for account access records. Unified status enum that covers all service types.

## Response `200`

Paginated list of account access records with pagination metadata

- PaginatedResponseAccountAccess
  - `results` object, required
    - `data` AccountAccess[], required
      - `id` string, required — Unique identifier for the account.
      - `accountName` string, required — Account name or email address (primary identifier).
      - `owner` string, nullable — Display name of the account owner, or null when the column is visible but unknown.
      - `role` string[] — Account roles; empty array when the column is visible but has no roles.
      - `status` 'ACTIVE' | 'DEACTIVATED' | 'UNKNOWN' — Account status values for account access records. Unified status enum that covers all service types.
      - `mfa` boolean, nullable — Multi-factor authentication (MFA) status when present. `true` = MFA enabled, `false` = MFA not enabled, `null` = visible but unknown.
      - `createdDate` string, date-time, nullable — Account creation date when present, or null when visible but absent.
      - `deactivatedDate` string, date-time, nullable — Account deactivation date when present, or null when active.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)