
Pratula.69048 (Customer) asked a question.
I have setup access certification based on attribute changes in Okta user profile. User gets added to a Okta group which triggers ad-hoc access certification (I am doing this using Okta APIs to create campaign and then launch it for users manager)
Is there a way to use Workflows to clean the Okta group after the campaign is closed by manager or 30 days (certification campaign length)? This is essentially the last piece of the flow.

@Pratula.69048 (Customer) -- This should be possible.
The event: certification.campaign.close. occurs when the campaign closes out. This event is event-hook-eligible meaning Okta Event Hooks can be used to deliver this System Log event to Okta Workflows (API Endpoint).
You could then take the campaign ID from the received event and search the system Log for that campaign ID and certification.campaign.item.decide events which will include all of the items in the campaign and information about that resource. Here's an example:
"displayMessage": "Access certification review decision: UNREVIEWED",
"eventType": "certification.campaign.item.decide",
"outcome": {
"result": "SUCCESS",
"reason": null
"debugContext": {
"debugData": {
"campaignItemPrincipalId": "00u1hhDFSDFDFSg5d7",
"campaignItemPrincipalName": "okta user23",
"campaignId": "ici1dlw3fsdfdssaNN5d6",
"campaignItemDecision": "UNREVIEWED",
"campaignTemplateName": "eventLogTest",
"campaignItemResourceName": "test-group-1",
"campaignItemReviewerId": "00urg74DFDFD4H5d6",
"campaignItemReviewerName": "tim laborn",
"campaignItemRemediationStatus": "NONE",
"campaignItemRemediation": "NO_ACTION",
"campaignItemId": "icr1djfsdfde4yjJB25d6",
"campaignItemResourceId": "00gfsd1gq70jGOfdsssd7",
"campaignItemResourceStatus": "ACTIVE",
"campaignTemplateId": "ici1dlw3zUDFDoCNN5d6",
"campaignItemResourceType": "GROUP"
}
You can then evaluate each of those payloads to determine if you want to take action against them or not.