Access review

Security and IT teams review access every quarter: who can see which documents, and what is shared publicly. This example lists every board the key can open, everyone who can open it and with which role, whether the access comes from the space or the board, and whether the board has a public link and a password. It also flags what deserves a look.

Download the code (Node.js 18 or later, no packages)

What it creates

• access-<date>.csv, one row per person per board: board, space, link, email, role, where the access comes from, whether the person is outside your company domain, and the public link state.

• A short list of what to check: public links without a password, and people outside your domain with edit rights.

How it works

1. List the spaces for their names.

2. List every board with GET /boards, following nextCursor until hasMore is false. See Pagination.

3. For each board, list who can open it with GET /boards/{boardId}/members. inheritedFrom says when access comes from the space.

4. When publicLink is true, read the public link for its URL and whether it has a password.

A large workspace makes many requests. The client in lib/mockflow.js waits and retries when the API answers 429, using Retry-After, so the review finishes within the plan's rate limit.

Run the example

Create an API key in the developer console with the scopes user:read and boards:read, then set your domain and run it:

cp .env.example .env        # paste your key and COMPANY_DOMAIN into .env
node access-review.js

The key code

for await (const board of mf.paginate('/boards')) {
  const members = await mf.get(`/boards/${board.id}/members`);
  const link = members.publicLink ? await mf.get(`/boards/${board.id}/public-link`) : { enabled: false };

  if (link.enabled && !link.passwordProtected) flags.push(`Public link with no password: ${board.title}`);
  for (const m of members.data) {
    rows.push([board.title, board.url, m.email, m.role, m.inheritedFrom ? 'space' : 'board']);
  }
}

Acting on the review

To remove someone, unshare the space with DELETE /spaces/{spaceId}/members/{email}. To turn off or protect a public link, use PUT /boards/{boardId}/public-link.

What you need

An API key with user:read and boards:read, made by someone who can open the boards to review. Every plan.