Multi-party approvals required for sensitive user-access API actions from July 27, 2026

Inviting users (CustomerUserAccessInvitationService) and updating or removing user access (CustomerUserAccessService) may now return a pending MultiPartyAuthReview instead of taking effect immediately; a second administrator must approve via MultiPartyAuthReviewService.ResolveMultiPartyAuthReview. Support was added to v24.2, v23.3, v22.2 and v21.2.

Pending reviews are queried from the multi_party_auth_review resource (review_status = 'PENDING'); approval can come from a human or a service account with administrator privileges other than the requestor, and the requestor can revoke a pending review.