Describe the bug
When configuring approval settings for roles using the Put Approval Config API, the email templates defined in emailConfig are not being triggered as expected.
Reminder emails are triggering the default Access Request Reviewer template instead of approval_request_reminder
Timeout (auto-expiration) emails are triggering the Access Request Decision template instead of approval_request_timeout
To Reproduce
Call Put Approval Config API with "scope": "ROLE" and custom emailConfig
Enable reminder with cron schedule (*/1 * * * *)
Enable timeout (daysUntilTimeout = 1)
Submit an access request for a role
Wait for reminder and timeout triggers
Observe the email templates used
Expected behavior
Reminder emails should use approval_request_reminder
Timeout emails should use approval_request_timeout
Templates configured in emailConfig should be honored
Actual behavior
Reminder emails use default Access Request Reviewer template
Timeout emails use Access Request Decision template
Configured templates are ignored
Configuration Used
{
"id": "<ROLE_ID>",
"scope": "ROLE",
"reminderConfig": {
"enabled": true,
"daysUntilFirstReminder": 0,
"reminderCronSchedule": "*/1 * * * *",
"maxReminders": 3
},
"escalationConfig": {
"enabled": false,
"daysUntilFirstEscalation": 0,
"escalationCronSchedule": "",
"escalationChain": []
},
"timeoutConfig": {
"enabled": true,
"daysUntilTimeout": 1,
"timeoutResult": "EXPIRED"
},
"cronTimezone": {
"location": "America/New_York",
"offset": ""
},
"serialChain": [],
"requiresComment": "ALL",
"autoApprove": "OFF",
"fallbackApprover": {},
"emailConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
},
"teamsConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
},
"slackConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
}
}
Additional context
API call succeeds with no errors
Configuration is saved correctly
Issue occurs during email trigger execution
Default templates appear to override API configuration
Questions
Are custom email templates supported for role-based approvals?
Does ROLE scope ignore emailConfig overrides?
How can we configure templates for access revoke events?
Are system templates overriding API configuration?
Describe the bug
When configuring approval settings for roles using the Put Approval Config API, the email templates defined in emailConfig are not being triggered as expected.
Reminder emails are triggering the default Access Request Reviewer template instead of approval_request_reminder
Timeout (auto-expiration) emails are triggering the Access Request Decision template instead of approval_request_timeout
To Reproduce
Call Put Approval Config API with "scope": "ROLE" and custom emailConfig
Enable reminder with cron schedule (*/1 * * * *)
Enable timeout (daysUntilTimeout = 1)
Submit an access request for a role
Wait for reminder and timeout triggers
Observe the email templates used
Expected behavior
Reminder emails should use approval_request_reminder
Timeout emails should use approval_request_timeout
Templates configured in emailConfig should be honored
Actual behavior
Reminder emails use default Access Request Reviewer template
Timeout emails use Access Request Decision template
Configured templates are ignored
Configuration Used
{
"id": "<ROLE_ID>",
"scope": "ROLE",
"reminderConfig": {
"enabled": true,
"daysUntilFirstReminder": 0,
"reminderCronSchedule": "*/1 * * * *",
"maxReminders": 3
},
"escalationConfig": {
"enabled": false,
"daysUntilFirstEscalation": 0,
"escalationCronSchedule": "",
"escalationChain": []
},
"timeoutConfig": {
"enabled": true,
"daysUntilTimeout": 1,
"timeoutResult": "EXPIRED"
},
"cronTimezone": {
"location": "America/New_York",
"offset": ""
},
"serialChain": [],
"requiresComment": "ALL",
"autoApprove": "OFF",
"fallbackApprover": {},
"emailConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
},
"teamsConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
},
"slackConfig": {
"assignedTemplateKey": "approval_request_notification",
"requesterCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"requesteeCompletedTemplateKey": "access_request_decision_email_for_requested-for_identity",
"commentedTemplateKey": "approval_commented_notification",
"reassignedTemplateKey": "access_request_reassignment",
"reminderTemplateKey": "approval_request_reminder",
"approverEscalationTemplateKey": "approval_request_escalation_approver",
"requesterEscalationTemplateKey": "approval_request_escalation_requester",
"timeoutTemplateKey": "approval_request_timeout"
}
}
Additional context
API call succeeds with no errors
Configuration is saved correctly
Issue occurs during email trigger execution
Default templates appear to override API configuration
Questions
Are custom email templates supported for role-based approvals?
Does ROLE scope ignore emailConfig overrides?
How can we configure templates for access revoke events?
Are system templates overriding API configuration?