Documentation
PIM Manager API
Pro feature: using the PIM Manager API from scripts, services and AI assistants is part of PIM Manager Pro.
The routine routes of the PIM Manager API. Paths are relative to your own PIM Manager address. Generated from the code of this version. The complete reference, filtered to your role, is in your PIM Manager: Settings > API and MCP reference.
109 routes · PIM Manager 3.0.70 · MCP tools
Every path is relative to your own PIM Manager address. This public page lists the routine routes; the full reference for your role is inside PIM Manager after you sign in.
access-report
- GET /api/access-report/who-can
Everything one person can reach, with the path to each.
Role: Reader
Requires: Reader or higher.
- GET /api/access-report/who-has
Everyone who can activate one role or target.
Role: Reader
Requires: Reader or higher.
access-review-campaigns
- GET /api/access-review-campaigns
The access review campaigns: what is open, for whom and how far along.
Role: Reader
Requires: Reader or higher.
- POST /api/access-review-campaigns/decide
Keep or remove one person in an access review campaign.
Role: Reader · JSON body
Requires: Reader or higher.
access-review-rules
- GET /api/access-review-rules
The access review rules and the departments they apply to.
Role: Reader
Requires: Reader or higher.
access-reviews
- GET /api/access-reviews
The access reviews: definitions, current instances, decisions and counts.
Role: Reader
Requires: Reader or higher.
- POST /api/access-reviews/decision
Record one access review decision, with a justification.
Role: Admin · Pro feature: reviews.campaigns · JSON body
Requires: Admin or higher.
- GET /api/access-reviews/evidence
The evidence package of one access review instance.
Role: Reader · Pro feature: reports.evidence
Requires: Reader or higher.
- GET /api/access-reviews/overdue
The access reviews that are overdue or due soon.
Role: Reader
Requires: Reader or higher.
- POST /api/access-reviews/reminders
Send a reminder to the reviewers of the reviews that are due.
Role: Admin · Pro feature: reviews.campaigns · JSON body
Requires: Admin or higher.
account-states
- GET /api/account-states
The state of every administrator account, in plain words.
Role: Admin
Requires: Admin or higher.
active-assignments
- GET /api/active-assignments
The active and eligible PIM assignments right now, paged and filterable.
Role: Admin
Requires: Admin or higher.
admin-accounts
- GET /api/admin-accounts
The administrator accounts PIM manages.
Role: Reader
Requires: Reader or higher.
admin-templates
- GET /api/admin-templates
The prepared administrator templates the onboarding wizard offers.
Role: Reader
Requires: Reader or higher.
alerts
- GET /api/alerts
The alerts that were raised: when, which event and who was told.
Role: Reader
Requires: Reader or higher.
approvals
- GET /api/approvals
The changes waiting for a second person.
Role: Reader
Requires: Reader or higher.
- POST /api/approvals
Ask for a change that needs a second person to approve it.
Role: Admin · JSON body
Requires: Admin or higher.
- POST /api/approvals/decide
Approve or deny one waiting change (never your own).
Role: Admin · JSON body
Requires: Admin or higher.
asbuilt
- GET /api/asbuilt
The as-built description of this environment.
Role: Admin
Requires: Admin or higher.
- GET /api/asbuilt/pdf
The as-built document of this environment, as a PDF.
Role: Admin
Requires: Admin or higher.
attention
- GET /api/attention
What waits for a person right now (the counts on the menu).
Role: Reader
Requires: Reader or higher.
audit
- GET /api/audit
The audit trail: who changed what, and when.
Role: Admin
Requires: Admin or higher.
- GET /api/audit/export
The audit trail as a download.
Role: Admin · Pro feature: reports.evidence
Requires: Admin or higher.
autoextend
- POST /api/autoextend/decide
Extend one upcoming auto-extension or let it end, with a reason.
Role: Admin · JSON body
Requires: Admin or higher.
- GET /api/autoextend/upcoming
The access that runs out soon and what auto-extend will do with each.
Role: Reader
Requires: Reader or higher.
commit-history
- GET /api/commit-history
The history of saved changes.
Role: Reader
Requires: Reader or higher.
- GET /api/commit-history/{p1}
One saved change and its rows, by its id.
Role: Reader · Parameters: p1 (path, required)
Requires: Reader or higher.
commit-status
- GET /api/commit-status/{p1}
What happened to a commit, by its id.
Role: Reader · Parameters: p1 (path, required)
Requires: Reader or higher.
commits
- GET /api/commits
The recent commits and how far each change has come.
Role: Reader
Requires: Reader or higher.
company-review
- POST /api/company-review/answer
Answer for one person in a company review.
Role: Reader · Pro feature: consultants.review · JSON body
Requires: Reader or higher.
company-reviews
- GET /api/company-reviews
The company reviews and their answers.
Role: Reader · Pro feature: rfa.portal
Requires: Reader or higher.
conformance
- GET /api/conformance
How far this environment is from the latest template versions.
Role: Reader
Requires: Reader or higher.
- GET /api/conformance/exemptions
The template exemptions and the state of each.
Role: Reader
Requires: Reader or higher.
- GET /api/conformance/fleet
Template conformance across every tenant.
Role: Reader
Requires: Reader or higher.
- GET /api/conformance/ring-plan
Where a template version would go next, ring by ring.
Role: Reader
Requires: Reader or higher.
- GET /api/conformance/templates
The templates and their versions.
Role: Reader
Requires: Reader or higher.
coverage
- GET /api/coverage
Privileged access in the tenant that PIM does not manage yet (the last coverage report).
Role: Reader
Requires: Reader or higher.
- POST /api/coverage/check
Build a new coverage report now.
Role: Admin · Pro feature: coverage.gaps · JSON body
Requires: Admin or higher.
custom-workloads
- GET /api/custom-workloads
The custom workloads and where each is used.
Role: Reader
Requires: Reader or higher.
- GET /api/custom-workloads/export
One custom workload as a template file.
Role: Reader
Requires: Reader or higher.
directory
- GET /api/directory/groups
Look up groups in the directory by name.
Role: Admin
Requires: Admin or higher.
- GET /api/directory/people
Look up people in the directory by name.
Role: Admin
Requires: Admin or higher.
discovered-resources
- GET /api/discovered-resources
The resources found in the tenant since the last acknowledgement.
Role: Reader
Requires: Reader or higher.
discovery-decisions
- POST /api/discovery-decisions
Create, ignore or re-add one discovered item.
Role: Admin · Pro feature: discovery.sweep · JSON body
Requires: Admin or higher.
discovery-inbox
- GET /api/discovery-inbox
The newly discovered items waiting for a decision.
Role: Reader
Requires: Reader or higher.
discovery-policy
- GET /api/discovery-policy
What happens with each kind of newly discovered resource.
Role: Reader
Requires: Reader or higher.
docs
- GET /api/docs
The product documentation shipped with this version.
Role: Reader
Requires: Reader or higher.
- GET /api/docs/page
One page of the product documentation.
Role: Reader
Requires: Reader or higher.
drift
- GET /api/drift
Where the tenant differs from the configuration (the last drift snapshot).
Role: Reader
Requires: Reader or higher.
engine-failures
- GET /api/engine-failures
The items the engine could not apply on its last run, with the cause and the fix.
Role: Reader
Requires: Reader or higher.
environment-report
- GET /api/environment-report
The architecture and settings report of this environment.
Role: Admin
Requires: Admin or higher.
group-states
- GET /api/group-states
The state of every group, in plain words.
Role: Admin
Requires: Admin or higher.
guards
- GET /api/guards
The guards that stopped a change, newest first.
Role: Reader
Requires: Reader or higher.
home
- GET /api/home
The tiles of the Overview page.
Role: Reader
Requires: Reader or higher.
hybrid-ad
- GET /api/hybrid-ad/live
The latest passes of the Active Directory sync.
Role: Reader
Requires: Reader or higher.
- GET /api/hybrid-ad/server-groups/waiting
The new server groups waiting for approval.
Role: Admin
Requires: Admin or higher.
- GET /api/hybrid-ad/waiting
The Active Directory groups whose membership sync waits for a decision.
Role: Admin
Requires: Admin or higher.
impact
- GET /api/impact
The impact counters of the Dashboard.
Role: Reader
Requires: Reader or higher.
job-schedule
- GET /api/job-schedule
The engine jobs, whether each is on, and how often each runs.
Role: Reader
Requires: Reader or higher.
- POST /api/job-schedule/run-now
Start one scheduled job at once.
Role: SuperAdmin · JSON body
Requires: SuperAdmin or higher.
jobs
- GET /api/jobs
The engine jobs with their last and next run.
Role: Reader
Requires: Reader or higher.
- POST /api/jobs/ack
Acknowledge a failed run, or take the acknowledgement back.
Role: Admin · JSON body
Requires: Admin or higher.
- POST /api/jobs/cancel
Cancel the running run of one engine job.
Role: SuperAdmin · JSON body
Requires: SuperAdmin or higher.
- GET /api/jobs/history
The recent runs of one engine job.
Role: Reader
Requires: Reader or higher.
- GET /api/jobs/log
The log of one job run.
Role: Reader
Requires: Reader or higher.
- POST /api/jobs/run
Run one engine job now.
Role: Admin · JSON body
Requires: Admin or higher.
map-risk
- GET /api/map-risk
The risk marks on the Delegation Map.
Role: Reader
Requires: Reader or higher.
map-search
- GET /api/map-search
Find a node on the Delegation Map.
Role: Reader
Requires: Reader or higher.
naming-conventions
- GET /api/naming-conventions
The naming conventions for groups and accounts.
Role: Reader
Requires: Reader or higher.
owner
- POST /api/owner/extend
Extend one person's access to a new date, with a reason.
Role: Reader · JSON body
Requires: Reader or higher.
- POST /api/owner/keep
Keep one person's access for another period, with a reason.
Role: Reader · JSON body
Requires: Reader or higher.
- GET /api/owner/people
The people a department owner is asked to review.
Role: Reader
Requires: Reader or higher.
- POST /api/owner/remove
Ask for one person to be offboarded, with a reason.
Role: Reader · JSON body
Requires: Reader or higher.
pending
- GET /api/pending
Every change staged by every administrator, not yet saved.
Role: Reader
Requires: Reader or higher.
- PUT /api/pending/{p1}
Stage your changes to one list.
Role: Reader · Parameters: p1 (path, required) · JSON body
Requires: Reader or higher.
pending-discard
- POST /api/pending-discard
Discard one staged change, with a reason.
Role: Admin · JSON body
Requires: Admin or higher.
pending-discard-all
- POST /api/pending-discard-all
Discard every staged change, with a reason.
Role: SuperAdmin · JSON body
Requires: SuperAdmin or higher.
policy-choices
- GET /api/policy-choices
For each policy setting: the Microsoft default, the recommendation and the current value.
Role: Admin
Requires: Admin or higher.
policy-templates
- GET /api/policy-templates
The policy templates and where each is used.
Role: Reader
Requires: Reader or higher.
preflight
- GET /api/preflight
Check the saved configuration for problems.
Role: Reader
Requires: Reader or higher.
- POST /api/preflight
Check the configuration with the staged changes for problems.
Role: Reader · JSON body
Requires: Reader or higher.
queue
- GET /api/queue
The change queue: what is waiting to be applied.
Role: Reader
Requires: Reader or higher.
- POST /api/queue/commit
Commit queued changes so the engine applies them.
Role: Admin · JSON body
Requires: Admin or higher.
- POST /api/queue/discard
Discard queued changes that are waiting or failed, with a reason.
Role: Admin · JSON body
Requires: Admin or higher.
reconcile
- GET /api/reconcile/state
Whether the daily reconcile is paused, and its last removal report.
Role: Reader
Requires: Reader or higher.
reports
- GET /api/reports/management
The management report as a PowerPoint file.
Role: Reader · Pro feature: reports.management
Requires: Reader or higher.
- GET /api/reports/management/latest
The latest stored monthly management report.
Role: Reader · Pro feature: reports.management
Requires: Reader or higher.
rfa
- POST /api/rfa/decide
Approve or deny one access request.
Role: Reader · Pro feature: rfa.portal · JSON body
Requires: Reader or higher.
- POST /api/rfa/end
End one granted access request.
Role: Reader · Pro feature: rfa.portal · JSON body
Requires: Reader or higher.
- GET /api/rfa/requests
The access requests you can see.
Role: Reader
Requires: Reader or higher.
role-lookup
- GET /api/role-lookup/compare
Compare who and what two roles reach.
Role: Reader
Requires: Reader or higher.
- GET /api/role-lookup/reverse
Everything that grants one role.
Role: Reader
Requires: Reader or higher.
role-permissions
- GET /api/role-permissions
The permissions one role grants.
Role: Reader
Requires: Reader or higher.
- GET /api/role-permissions/by-action
The roles that grant one action, narrowest first.
Role: Reader
Requires: Reader or higher.
search
- GET /api/search
Search admins, groups, roles and definitions.
Role: Reader
Requires: Reader or higher.
template-state
- GET /api/template-state
Which permission templates are switched off.
Role: Reader
Requires: Reader or higher.
templates
- GET /api/templates
The permission templates and what importing each would add.
Role: Reader
Requires: Reader or higher.
tenant-lists
- GET /api/tenant-lists
The lists of roles, groups and scopes read from the tenant.
Role: Reader
Requires: Reader or higher.
tier-impact
- GET /api/tier-impact
Who can reach your most sensitive roles and groups, and through what.
Role: Reader · Pro feature: reports.tier
Requires: Reader or higher.
unmanaged-admins
- GET /api/unmanaged-admins
Privileged accounts in the tenant that PIM does not manage, with what they hold.
Role: Admin
Requires: Admin or higher.
warning-overrides
- GET /api/warning-overrides
The acknowledged warnings.
Role: Reader
Requires: Reader or higher.
workload-crawl
- GET /api/workload-crawl
The last crawl of the workloads.
Role: Reader
Requires: Reader or higher.
- POST /api/workload-crawl
Crawl the workloads now.
Role: Admin · JSON body
Requires: Admin or higher.
workload-exemptions
- GET /api/workload-exemptions
The workload exemptions.
Role: Reader
Requires: Reader or higher.
workload-prereqs
- GET /api/workload-prereqs
The prerequisites of each workload and whether each is met.
Role: Reader
Requires: Reader or higher.
- POST /api/workload-prereqs/confirm
Confirm, skip or withdraw one workload prerequisite.
Role: Admin · JSON body
Requires: Admin or higher.
workload-recon
- GET /api/workload-recon
How the workload assignments compare with what the crawl found.
Role: Reader
Requires: Reader or higher.
workload-roles
- GET /api/workload-roles
The roles each workload offers.
Role: Reader
Requires: Reader or higher.
workloads
- GET /api/workloads
The workload connectors.
Role: Reader
Requires: Reader or higher.
No route matches.