Reports

Reports answer the questions auditors and access reviewers ask, such as who has access to what, who approved it, whether terminated people lost their access, and who can administer Owlie. Open Governance → Reports.

Find a report

The catalog groups reports by area: identities, access inventory, grants, requests and approvals, provisioning, joiners, movers and leavers, access reviews, policies, separation of duties, logging and change history, configuration, and administrators. Search matches report names and the questions each report answers, so searching "terminated" or "approved" finds the right one.

You see the reports your roles allow.

Preview a report

Choose the parameters and select Preview to see the first rows. Pickers suggest your organization's own resources, departments, integrations, campaigns, roles and constraints as you type. Leave a filter empty to include everything. Dates are calendar dates in your time zone. A period can be relative (such as Last quarter) or a custom range, and the end date is included. A preview reads current data and isn't stored.

Reports about people can narrow to the people you care about: by manager (optionally everyone below them), group, status, lifecycle state, type, department, title, or attributes with a fixed list of values, such as employee type. Every filter you set must match.

Choose columns and order

Under Columns and order, untick columns you don't need; identifier columns are always included so every row can be traced. Some reports offer an Order, such as newest or oldest first, which a run uses. Select a column heading in the preview to sort the rows loaded on screen; that order isn't applied to a run.

Save a report

Select Save as… to keep the parameters under a name. Turn on sharing to let everyone who can run the report use it. A relative period such as Last 30 days moves with each run, so a saved report always covers the latest period.

Saved reports are listed at the top of the catalog. Opening one fills in its parameters; change them and select Save… to update it, or save a copy under a new name. A saved report runs as whoever runs it, so it shows only what that person may see. Its owner can change or delete it; so can anyone with permission to manage reports, for shared reports.

Run a report and export it

Preview shows the first rows live, to check your parameters. Run report, beside it, reads every row in the background, as of one moment, so you can leave the page. If the run takes more than 30 seconds, you're notified when it finishes.

The run's page shows its Results, 100 rows a page. They're the rows the run read, not a fresh query, so they match the files exactly. From there you can export them:

• Export CSV opens in a spreadsheet, including Excel. For a very large run, select Prepare CSV first: it's prepared in the background, and Export CSV appears when it's ready. A prepared CSV is kept for 7 days.
• Export NDJSON is one JSON object per line, for scripts and other tools.
• Download manifest gives the evidence manifest.
• Times in the file are in UTC.
• Files are kept for 7 days unless your plan says otherwise, so export what you need to keep. The run's page and run history show how long. Each export, and each page of results you view, is recorded in the audit log.
• A run's file is limited in size, 50 MB unless your plan says otherwise. A larger result is cut short there, and the run's page says so: narrow the parameters and run it again, or read the full result through the API.

Run history lists your runs. Administrators with permission to manage reports see everyone's runs.

To free the space sooner, select the delete button on a run in Run history, or Delete run on its page. Its files and results are deleted at once and can't be recovered; the audit log keeps its record. A run can't be deleted while it's running, or while a sign-off of it is in progress.

Sign off a run

On a finished run's results page, select Request sign-off, choose the signers and how many approvals are needed, and optionally a due date and a note. Signers must be able to read the report; you can't sign off your own request. Signers are notified, reminded as the due date nears and passes, and escalated to their manager when overdue. Each signer signs off or rejects, with an optional comment. The sign-off records the run's manifest digest, so it attests exactly that file, which is kept until the sign-off ends. Sign-offs waiting for you are listed at the top of the catalog.

Evidence manifest

Every finished run has an evidence manifest, which you can download from its results page. It records:

• the report and its version;
• the parameters and time zone;
• when the data was read;
• the row count;
• a SHA-256 digest of the run's file.

Anyone holding the file can check it against the manifest. Split the file into parts of the manifest's part size, hash each part with SHA-256, and hash the joined digests: the result must match the manifest's data digest. The manifest's own digest is also recorded in the audit log, so a manifest can be checked against Owlie.

Permissions

Permission	Allows
View reports	Browse the catalog and preview reports.
Export reports	Run reports and export your own runs' files.
Manage reports	See and cancel anyone's runs, and change or delete anyone's shared saved reports.
Include personal data in reports	See columns such as email addresses in previews and runs. Without it they are empty.
Sign off reports	Ask for and give sign-offs on runs.

Each report also needs the permissions for the data it shows. For example, an access review report needs permission to read review campaigns. The Owner, Admin and Auditor roles can run and export reports. The Operator role can view and preview reports but not run them.