# Access review

> List every board, who can open it and its public link state, as one CSV for IT.

Source: https://mockflow.com/developers/examples/api/access-review

Security and IT teams review access every quarter: who can see which documents, and what is shared publicly. This example lists every board the key can open, everyone who can open it and with which role, whether the access comes from the space or the board, and whether the board has a public link and a password. It also flags what deserves a look.

[**Download the code**](/developers/assets/examples/mockflow-access-review.zip) (Node.js 18 or later, no packages)

## What it creates

- `access-<date>.csv`, one row per person per board: board, space, link, email, role, where the access comes from, whether the person is outside your company domain, and the public link state.
- A short list of what to check: public links without a password, and people outside your domain with edit rights.

## How it works

1. [List the spaces](/developers/reference/spaces/list-spaces) for their names.
2. [List every board](/developers/reference/boards/list-boards) with `GET /boards`, following `nextCursor` until `hasMore` is false. See [Pagination](/developers/concepts/pagination).
3. For each board, [list who can open it](/developers/reference/members/list-members) with `GET /boards/{boardId}/members`. `inheritedFrom` says when access comes from the space.
4. When `publicLink` is true, [read the public link](/developers/reference/members/get-public-link) for its URL and whether it has a password.

A large workspace makes many requests. The client in `lib/mockflow.js` waits and retries when the API answers `429`, using `Retry-After`, so the review finishes within the plan's [rate limit](/developers/concepts/rate-limits).

## Run the example

Create an API key in the [developer console](/developers/console/) with the scopes `user:read` and `boards:read`, then set your domain and run it:

```bash
cp .env.example .env        # paste your key and COMPANY_DOMAIN into .env
node access-review.js
```

## The key code

```javascript
for await (const board of mf.paginate('/boards')) {
  const members = await mf.get(`/boards/${board.id}/members`);
  const link = members.publicLink ? await mf.get(`/boards/${board.id}/public-link`) : { enabled: false };

  if (link.enabled && !link.passwordProtected) flags.push(`Public link with no password: ${board.title}`);
  for (const m of members.data) {
    rows.push([board.title, board.url, m.email, m.role, m.inheritedFrom ? 'space' : 'board']);
  }
}
```

## Acting on the review

To remove someone, [unshare the space](/developers/reference/spaces/remove-space-member) with `DELETE /spaces/{spaceId}/members/{email}`. To turn off or protect a public link, use [`PUT /boards/{boardId}/public-link`](/developers/reference/members/set-public-link).

## What you need

An API key with `user:read` and `boards:read`, made by someone who can open the boards to review. Every plan.