# Report for Deleted Access Items and Users Who Previously Had Them **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** sailpoint-identity-security\ **Created:** [November 25, 2025, 10:40am UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218 "2025-11-25T10:40:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sxxnex](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sxxnex](https://developer.sailpoint.com/discuss/u/sxxnex)\ **Post date:** [November 25, 2025, 10:40am UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/1 "2025-11-25T10:40:29Z")
Hi everyone, I would like to check if the following is possible in Identity Security Cloud. I’m trying to generate a **combined report/list** that shows **deleted Roles or deleted Entitlements** _together with_ the list of **Identities who previously had access** to those items. **Current situation:** It seems that I can verify this only on a per-user basis using **Access History** , but this doesn’t give me a consolidated view. ![스크린샷 2025-11-25 193615](https://global.discourse-cdn.com/sailpoint/original/3X/8/c/8c8ba85c26aab4bc387310d99c1b2a331d0a5900.png) ![스크린샷 2025-11-25 193629](https://global.discourse-cdn.com/sailpoint/original/3X/e/3/e3e65230eb70d3d11f4c4d2c177246089c70954b.png) **Goal:** I want to know if there is any way to produce a **single report or unified list** that displays: - Deleted Roles / deleted Entitlements - And the Identities who had those accesses before deletion If anyone has done something similar or knows whether this is supported (via Search, Reports, Access History API, etc.), your guidance would be greatly appreciated. Thank you! ---
**Author:** ![HussainshaSyed001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/hussainshasyed001/32/28234_2.png) [@HussainshaSyed001](https://developer.sailpoint.com/discuss/u/HussainshaSyed001)\ **Post date:** [November 25, 2025, 11:18am UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/2 "2025-11-25T11:18:01Z")
use API /access-request-status and look response have REVOKE\_ACCESS and from that you can pull accordingly ---
**Author:** ![sxxnex](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sxxnex](https://developer.sailpoint.com/discuss/u/sxxnex)\ **Post date:** [November 26, 2025, 12:57am UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/3 "2025-11-26T00:57:32Z")
This isn’t a case where a user’s access was revoked — the Role or Entitlement itself was deleted. What I’m referring to is the list of users who had those permissions _before_ they were deleted. ---
**Author:** ![schattopadhy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/schattopadhy/32/8854_2.png) [@schattopadhy](https://developer.sailpoint.com/discuss/u/schattopadhy)\ **Post date:** [November 26, 2025, 6:29am UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/4 "2025-11-26T06:29:10Z")
> [@sxxnex](#): > > a user’s access was revoked — the Role or Entitlement itself was deleted. What I’m referring to is the list of users who had those permissions _before_ they were deleted. @sxxnex you can check events with delete role passed as shown below ![image](https://global.discourse-cdn.com/sailpoint/original/3X/d/c/dcc30db49b33038d162bf5ecb47b11ab2a1ed139.png) ---
**Author:** ![suresh4iam](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/suresh4iam/32/29513_2.png) [@suresh4iam](https://developer.sailpoint.com/discuss/u/suresh4iam)\ **Post date:** [November 26, 2025, 1:05pm UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/6 "2025-11-26T13:05:10Z")
I don’t think you can get the combined report directly what you required. But I would use multiple ISC APIs to try to build the report via Workflow or any programming language. 1. Get the list of deleted role or entitlement events by using Search API [search-post | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v3/search-post) 2. Get the role name from the Search response, I’m not sure whether it returns role/entitlement IDs to use it in the next step. 3. Use the identity history API [list-identity-snapshot-access-items | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/list-identity-snapshot-access-items) to loop through all the identities by using access item name filter and get the list. 4. Or try to use another search API instead of steps 2 & 3 to get the “Remove Role Passed” events with role name attribute value. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [January 25, 2026, 1:05pm UTC](https://developer.sailpoint.com/discuss/t/report-for-deleted-access-items-and-users-who-previously-had-them/189218/7 "2026-01-25T13:05:27Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.