# Set expiration date for existing access **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** sailpoint-identity-security\ **Created:** [March 19, 2025, 7:16pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872 "2025-03-19T19:16:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lathasakthivel](https://avatars.discourse-cdn.com/v4/letter/l/aeb1de/32.png) [@lathasakthivel](https://developer.sailpoint.com/discuss/u/lathasakthivel)\ **Post date:** [March 19, 2025, 7:16pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/1 "2025-03-19T19:16:24Z")
We have migrated from IIQ to ISC, and there are hundreds of access requests in IIQ with future sunset dates. During the migration, ISC did not capture these sunset dates. We attempted to submit bulk access requests to set the expiration dates, but this approach is not working since the users already have the access. I also tried submitting revoke access requests with expiration dates, but this only created identity events, not access requests. Is there another way to achieve this? ---
**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\ **Post date:** [March 19, 2025, 10:24pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/2 "2025-03-19T22:24:24Z")
We cannot set sunset on existing access, Unlike IIQ you cannot set in the backend, in IIQ we can just edit in debug page. Best way is launch Access Reviews, Revoke access and resubmit the access request with sunset, better without any approvals as one time work. ---
**Author:** ![lathasakthivel](https://avatars.discourse-cdn.com/v4/letter/l/aeb1de/32.png) [@lathasakthivel](https://developer.sailpoint.com/discuss/u/lathasakthivel)\ **Post date:** [March 20, 2025, 12:56am UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/3 "2025-03-20T00:56:05Z")
Is there an option to do this through the API? I used the below API to revoke the access with remove date. Even that is not creating the access request ## https://$tenant.api.identitynow.com/beta/access-requests [create-access-request | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/create-access-request) ---
**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\ **Post date:** [March 20, 2025, 9:19am UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/4 "2025-03-20T09:19:39Z")
Thank you, didn’t observe this feature. I tried to add sunset to the existing Role and it is working fine. You don’t see end date in UI, get this user in search and download the report with include Access Details, you can see **Access Expiration** date there in the excel file. Below is the body I used, ```auto { "requestedFor": [ "16dhjsef7skedjhew73ioo8909000" ], "requestType": "REVOKE_ACCESS", "requestedItems": [ { "type": "ROLE", "id": "85555wefsdfeirfkdkmfvgjkeriieie", "comment": "testing", "clientMetadata": null, "removeDate": "2025-03-25T21:23:15.000Z" } ], "clientMetadata": null } ``` Form the docs **REVOKE\_ACCESS** - Can only be requested for a single identity at a time. - You cannot use an access request to revoke access from an identity if that access has been granted by role membership or by birthright provisioning. - Does not support self request. Only manager can request to revoke access for their directly managed employees. - If a `removeDate` is specified, then the access will be removed on that date and time only for roles, access profiles and entitlements. - Roles, access profiles, and entitlements can be requested for revocation. - Revoke requests for entitlements are limited to 1 entitlement per access request currently. - You can specify a `removeDate` if the access doesn’t already have a sunset date. The `removeDate` must be a future date, in the UTC timezone. - Allows a manager to request to revoke access for direct employees. A user with ORG\_ADMIN authority can also request to revoke access from anyone. ---
**Author:** ![lathasakthivel](https://avatars.discourse-cdn.com/v4/letter/l/aeb1de/32.png) [@lathasakthivel](https://developer.sailpoint.com/discuss/u/lathasakthivel)\ **Post date:** [March 20, 2025, 6:16pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/5 "2025-03-20T18:16:29Z")
with revoke\_access, I tried to set expiration date as future. It created the identity event. But the access was not revoked on the expiration date. Note: The entitlement doesn’t tag with any role. And I own the ORG\_ADMIN authority ---
**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\ **Post date:** [March 24, 2025, 2:33pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/6 "2025-03-24T14:33:46Z")
I updated end date for existing Role and it is removed successfully. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [May 23, 2025, 2:33pm UTC](https://developer.sailpoint.com/discuss/t/set-expiration-date-for-existing-access/104872/7 "2025-05-23T14:33:52Z")
Closed on May 23, 2025, 2:33pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.