# List mass deprovision holds

`GET /v1/directories/{directory_id}/deprovision-holds` · permission `directories:read`

Lists the directory's mass deprovision holds, open and decided, newest first: the count of held deprovisions, the status and the decision; never the held users. An open hold is approved or rejected with `POST /v1/directories/{directory_id}/deprovision-holds/{hold_id}:approve` or `:reject`; after 72 hours it is approved by timeout. Only forward paging exists; the cursor is bound to the directory.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `directory_id` | path | yes | SCIM directory ID (`dir_…`). |
| `limit` | query | no | 1–100, default 20. |
| `after` | query | no | The cursor from `list_metadata.after`. |

There is no request body.

## Response

`200 OK` with a page of holds.

```json
{
  "data": [
    {
      "id": "0190a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b",
      "status": "approved",
      "opened_at": "2026-10-20T09:00:00Z",
      "pending_count": 42,
      "decided_by": "api_key:key_01j9xr6s8t0v2w4x6y8z0a2b4d",
      "decided_at": "2026-10-20T10:00:00Z"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
```

`status` is `open`, `approved` or `rejected`. `decided_by` is `api_key:<key ID>`, `admin_portal_link:apl_…` or `timeout`; it and `decided_at` are `null` while the hold is open.

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `invalid_cursor` | The cursor is invalid or belongs to another directory. |
| 404 | `not_found` | The directory does not exist in this environment. |
| 422 | `validation_failed` | `limit` is out of range, or `before` or `order` was given (`unsupported`). |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | Directory sync is temporarily unavailable or not configured in this deployment; retry after the `Retry-After` period. |

## Example

```bash
curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/deprovision-holds?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

## Personal data

This endpoint carries personal data: directory (SCIM) users. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.