# Search query for the When an IDN campaign or other provisioning "revoke" fails (events where "Remove Entitlement Failed")

**URL:** <https://developer.sailpoint.com/discuss/t/search-query-for-the-when-an-idn-campaign-or-other-provisioning-revoke-fails-events-where-remove-entitlement-failed/68549>\
**Category:** SHF Discussion and Questions\
**Tags:** search, sailpoint-identity-security, entitlements\
**Created:** [June 25, 2024, 11:26am UTC](https://developer.sailpoint.com/discuss/t/search-query-for-the-when-an-idn-campaign-or-other-provisioning-revoke-fails-events-where-remove-entitlement-failed/68549 "2024-06-25T11:26:56Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![uday\_kilambi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/uday_kilambi/32/31482_2.png) [@uday\_kilambi](https://developer.sailpoint.com/discuss/u/uday_kilambi)\
**Post date:** [June 25, 2024, 6:05pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-the-when-an-idn-campaign-or-other-provisioning-revoke-fails-events-where-remove-entitlement-failed/68549/7 "2024-06-25T18:05:21Z")

</div>

Hi @mrahulbb ,

If you need a search query to get the list of revocation failures for certification, it can be as below for Events:

“\<source\_name\>” AND status:FAILED AND operation:REMOVE

But, it may not achieve an automated email initiation for failure, for that you need to go with workflow.

Regards,  
Uday Kilambi

---

_[View the full topic](https://developer.sailpoint.com/discuss/t/search-query-for-the-when-an-idn-campaign-or-other-provisioning-revoke-fails-events-where-remove-entitlement-failed/68549)._