List mass deprovision holds

GET /v1/directories/{directory_id}/deprovision-holds · permission directories:read

Lists the directory's mass deprovision holds, open and decided, newest first: the count of held deprovisions, the status and the decision; never the held users. An open hold is approved or rejected with POST /v1/directories/{directory_id}/deprovision-holds/{hold_id}:approve or :reject; after 72 hours it is approved by timeout. Only forward paging exists; the cursor is bound to the directory.

Request

Field Type Required Description
directory_id path yes SCIM directory ID (dir_…).
limit query no 1–100, default 20.
after query no The cursor from list_metadata.after.

There is no request body.

Response

200 OK with a page of holds.

{
  "data": [
    {
      "id": "0190a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b",
      "status": "approved",
      "opened_at": "2026-10-20T09:00:00Z",
      "pending_count": 42,
      "decided_by": "api_key:key_01j9xr6s8t0v2w4x6y8z0a2b4d",
      "decided_at": "2026-10-20T10:00:00Z"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}

status is open, approved or rejected. decided_by is api_key:<key ID>, admin_portal_link:apl_… or timeout; it and decided_at are null while the hold is open.

Errors

HTTP code When
400 invalid_cursor The cursor is invalid or belongs to another directory.
404 not_found The directory does not exist in this environment.
422 validation_failed limit is out of range, or before or order was given (unsupported).
401 unauthenticated The credential is missing, invalid or revoked.
403 insufficient_permissions The credential lacks the required permission.
429 rate_limited The rate limit was exceeded; retry after the Retry-After period.
503 service_unavailable Directory sync is temporarily unavailable or not configured in this deployment; retry after the Retry-After period.

Example

curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/deprovision-holds?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

Personal data

This endpoint carries personal data: directory (SCIM) users. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.