> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/shipped-mail-templates.md).
# Shipped mail templates
The complete inventory of shipped notification templates, so you customise an existing template instead of inventing one.
## What this is, and when you need it
OpenIAM ships **213** notification templates as `MAIL_TEMPLATE` rows. Almost every notification an administrator wants to change already exists; the usual mistake is creating a new template that nothing sends.
Find the template that the feature already uses, copy it, and change the copy.
{% hint style="danger" %}
`NEW_USER_EMAIL_SUPERVISOR` ships with the generated password in its body, via `${req.getNotificationParam("password").valueObj}`. If you enable supervisor notification on user creation, you are mailing credentials in clear text. Replace the body with an activation link before using it in production.
{% endhint %}
## Inventory
| Template ID | Name |
| -------------------------------- | --------------------------------------------------------------------------------------- |
| `1` | ACCOUNT\_LOCKED |
| `10` | REQUEST\_APPROVED |
| `100` | ADD\_GROUP\_TO\_GROUP\_REJECT |
| `101` | ADD\_ROLE\_TO\_GROUP\_NOTIFY |
| `102` | ADD\_ROLE\_TO\_GROUP\_APPROVED |
| `103` | ADD\_ROLE\_TO\_GROUP\_REJECT |
| `104` | ENTITLE\_RESOURCE\_TO\_GROUP\_NOTIFY |
| `105` | ENTITLE\_RESOURCE\_TO\_GROUP\_APPROVED |
| `106` | ENTITLE\_RESOURCE\_TO\_GROUP\_REJECT |
| `107` | ADD\_ROLE\_TO\_ROLE\_NOTIFY |
| `108` | ADD\_ROLE\_TO\_ROLE\_APPROVED |
| `109` | ADD\_ROLE\_TO\_ROLE\_REJECT |
| `11` | NEW\_USER\_EMAIL\_SUPERVISOR |
| `110` | ENTITLE\_RESOURCE\_TO\_ROLE\_NOTIFY |
| `111` | ENTITLE\_RESOURCE\_TO\_ROLE\_APPROVED |
| `112` | ENTITLE\_RESOURCE\_TO\_ROLE\_REJECT |
| `113` | ADD\_RESOURCE\_TO\_RESOURCE\_NOTIFY |
| `114` | ADD\_RESOURCE\_TO\_RESOURCE\_APPROVED |
| `115` | ADD\_RESOURCE\_TO\_RESOURCE\_REJECT |
| `116` | REMOVE\_GROUP\_FROM\_GROUP\_NOTIFY |
| `117` | REMOVE\_GROUP\_FROM\_GROUP\_APPROVED |
| `118` | REMOVE\_GROUP\_FROM\_GROUP\_REJECT |
| `119` | REMOVE\_ROLE\_FROM\_GROUP\_NOTIFY |
| `12` | REQUEST\_PASSWORD\_RESET |
| `120` | REMOVE\_ROLE\_FROM\_GROUP\_APPROVED |
| `121` | REMOVE\_ROLE\_FROM\_GROUP\_REJECT |
| `122` | DISENTITLE\_RESOURCE\_FROM\_GROUP\_NOTIFY |
| `123` | DISENTITLE\_RESOURCE\_FROM\_GROUP\_APPROVED |
| `124` | DISENTITLE\_RESOURCE\_FROM\_GROUP\_REJECT |
| `125` | REMOVE\_ROLE\_FROM\_ROLE\_NOTIFY |
| `126` | REMOVE\_ROLE\_FROM\_ROLE\_APPROVED |
| `127` | REMOVE\_ROLE\_FROM\_ROLE\_REJECT |
| `128` | DISENTITLE\_RESOURCE\_FROM\_ROLE\_NOTIFY |
| `129` | DISENTITLE\_RESOURCE\_FROM\_ROLE\_APPROVED |
| `13` | REQUEST\_LOGIN\_REMINDER |
| `130` | DISENTITLE\_RESOURCE\_FROM\_ROLE\_REJECT |
| `131` | REMOVE\_RESOURCE\_FROM\_RESOURCE\_NOTIFY |
| `132` | REMOVE\_RESOURCE\_FROM\_RESOURCE\_APPROVED |
| `133` | REMOVE\_RESOURCE\_FROM\_RESOURCE\_REJECT |
| `134` | RESOURCE\_CERTIFICATION\_NOTIFY |
| `135` | RESOURCE\_CERTIFICATION\_ACCEPTED |
| `136` | RESOURCE\_CERTIFICATION\_REJECT |
| `137` | TASK\_ASSIGNEE\_REMINDER |
| `138` | NEW\_USER\_ACTIVATION\_REMIND |
| `139` | NEW\_USER\_ACTIVATION\_NOTIFICATION |
| `14` | USER\_PASSWORD\_EMAIL |
| `140` | USER\_RESET\_PASSWORD\_ACTIVATION\_NOTIFICATION |
| `141` | DEPRECATED\_CREATE\_USER\_REQUEST |
| `141_1` | CREATE\_USER\_REQUEST |
| `142` | CREATE\_USER\_REQUEST\_REJECTED |
| `143` | CREATE\_USER\_REQUEST\_ACCEPTED |
| `144` | DEPRECATED\_DELEGATE\_TASK |
| `144_1` | DELEGATE\_TASK |
| `145` | DELETE\_WRONG\_TASK |
| `146` | USER\_TERMINATE\_NOTIFY\_SUPERVISOR |
| `147` | ORIGINAL\_APPROVER\_NOTIFY |
| `148` | CREATE\_PRIVILEGED\_ACCESS\_REQUEST\_REJECTED |
| `149` | CREATE\_PRIVILEGED\_ACCESS\_REQUEST\_ACCEPTED |
| `15` | FORGOT\_USER\_NAME |
| `150` | REVIEW\_ASSESS\_ON\_POSITION\_CHANGE |
| `151` | REVIEW\_ASSESS\_ON\_POSITION\_CHANGE\_ACCEPT\_NOTIFY |
| `153` | ACCESS\_IS\_ALMOST\_EXPIRED |
| `154` | REQUEST\_CHANGE\_PASSWORD |
| `155` | PASSWORD\_CHANGED\_NOTIFICATION |
| `156` | ESCALATE\_TASK |
| `157` | ORIGINAL\_APPROVER\_NOTIFY\_ABOUT\_MISSED\_TASK |
| `158` | APPROVER\_REMINDER |
| `16` | ADD\_USER\_TO\_ROLE\_NOTIFY |
| `160` | ACCESS\_CERTIFICATION\_NOTIFY — renamed from `ACCESS_CERTIFICATION_REMINDER`; see below |
| `161` | CREATE\_USER\_REQUEST\_STEP\_APPROVED |
| `17` | REMOVE\_USER\_FROM\_ROLE\_NOTIFY |
| `170` | DUPLICATE\_SELF\_REGISTRATION\_ATTEMPT |
| `18` | ADD\_USER\_TO\_GROUP\_NOTIFY |
| `19` | REMOVE\_USER\_FROM\_GROUP\_NOTIFY |
| `190` | MNG\_SYS\_CONNECTION\_ERROR |
| `191` | MNG\_SYS\_CONNECTION\_SUCCESS |
| `2` | PASSWORD\_NEAR\_EXPIRATION |
| `20` | ENTITLE\_USER\_TO\_RESOURCE\_NOTIFY |
| `200` | NEW\_LOGIN\_PARAMETER |
| `201` | NEW\_LOGIN\_PARAMETER\_APPROVAL\_LINK |
| `202` | CHANGE\_OBJECT\_ON\_RECONCILIATION |
| `203` | ACCESS\_REQUESTED\_ON\_BEHALF |
| `21` | DISENTITLE\_USER\_FROM\_RESOURCE\_NOTIFY |
| `22` | ADD\_USER\_TO\_ORG\_NOTIFY |
| `23` | REMOVE\_USER\_FROM\_ORG\_NOTIFY |
| `24` | ADD\_USER\_TO\_ROLE\_REJECT\_NOTIFY |
| `25` | REMOVE\_USER\_FROM\_ROLE\_REJECT\_NOTIFY |
| `26` | ADD\_USER\_TO\_GROUP\_REJECT\_NOTIFY |
| `260` | REVOKE\_ACCESS\_ACCEPT\_NOTIFY |
| `261` | REVOKE\_ACCESS\_REJECT\_NOTIFY |
| `27` | REMOVE\_USER\_FROM\_GROUP\_REJECT\_NOTIFY |
| `28` | ENTITLE\_USER\_TO\_RESOURCE\_REJECT\_NOTIFY |
| `29` | DISENTITLE\_USER\_FROM\_RESOURCE\_REJECT\_NOTIFY |
| `3` | PASSWORD\_EXPIRED |
| `30` | ADD\_USER\_TO\_ORG\_REJECT\_NOTIFY |
| `302` | SELF\_REGISTRATION\_NOTIFY |
| `303` | SELF\_REGISTRATION\_APPROVED |
| `304` | SELF\_REGISTRATION\_REJECT |
| `305` | NEW\_HIRE\_WITH\_APPROVAL\_NOTIFY |
| `306` | NEW\_HIRE\_WITH\_APPROVAL\_APPROVED |
| `307` | NEW\_HIRE\_WITH\_APPROVAL\_REJECT |
| `308` | REVIEW\_ASSESS\_ON\_POSITION\_CHANGE\_REJECT |
| `309` | SAVE\_LOGIN\_NOTIFY |
| `31` | REMOVE\_USER\_FROM\_ORG\_REJECT\_NOTIFY |
| `310` | SAVE\_LOGIN\_APPROVED |
| `311` | SAVE\_LOGIN\_REJECT |
| `312` | NEW\_ORGANIZATION\_NOTIFY |
| `313` | NEW\_ORGANIZATION\_APPROVED |
| `314` | NEW\_ORGANIZATION\_REJECT |
| `315` | EDIT\_ORGANIZATION\_NOTIFY |
| `316` | EDIT\_ORGANIZATION\_APPROVED |
| `317` | EDIT\_ORGANIZATION\_REJECT |
| `318` | TERMINATE\_USER\_NOTIFY |
| `319` | TERMINATE\_USER\_APPROVED |
| `32` | ADD\_USER\_TO\_ROLE\_ACCEPT\_NOTIFY |
| `320` | TERMINATE\_USER\_REJECT |
| `321` | CREATE\_PRIVILEGED\_ACCESS\_REQUEST\_NOTIFY |
| `33` | REMOVE\_USER\_FROM\_ROLE\_ACCEPT\_NOTIFY |
| `34` | ADD\_USER\_TO\_GROUP\_ACCEPT\_NOTIFY |
| `35` | REMOVE\_USER\_FROM\_GROUP\_ACCEPT\_NOTIFY |
| `36` | ENTITLE\_USER\_TO\_RESOURCE\_ACCEPT\_NOTIFY |
| `37` | DISENTITLE\_USER\_FROM\_RESOURCE\_ACCEPT\_NOTIFY |
| `38` | ADD\_USER\_TO\_ORG\_ACCEPT\_NOTIFY |
| `39` | REMOVE\_USER\_FROM\_ORG\_ACCEPT\_NOTIFY |
| `4` | ACCOUNT\_TERMINATED |
| `40` | EDIT\_USER\_NOTIFY |
| `41` | EDIT\_USER\_NOTIFY\_REJECT |
| `42` | EDIT\_USER\_NOTIFY\_ACCEPT |
| `43` | ATTESTATION\_REQUEST\_DONE |
| `44` | ATTESTATION\_REQUEST |
| `45` | GROUP\_ATTESTATION\_REQUEST\_DONE |
| `46` | GROUP\_ATTESTATION\_REQUEST |
| `47` | REMOVE\_SUPERIOR\_NOTIFY |
| `48` | ADD\_SUPERIOR\_NOTIFY |
| `49` | REPLACE\_SUPERIOR\_NOTIFY |
| `5` | ACCOUNT\_INACTIVE |
| `50` | REMOVE\_SUPERIOR\_ACCEPT |
| `51` | ADD\_SUPERIOR\_ACCEPT |
| `52` | REPLACE\_SUPERIOR\_ACCEPT |
| `53` | REMOVE\_SUPERIOR\_REJECT |
| `54` | ADD\_SUPERIOR\_REJECT |
| `55` | REPLACE\_SUPERIOR\_REJECT |
| `56` | DELETE\_LOGIN\_ACCEPT\_NOTIFY |
| `57` | ADD\_UPDATE\_LOGIN\_ACCEPT\_NOTIFY |
| `58` | DELETE\_LOGIN\_REJECT\_NOTIFY |
| `59` | ADD\_UPDATE\_LOGIN\_REJECT\_NOTIFY |
| `6` | ACCOUNT\_NEAR\_EXPIRATION |
| `60` | DELETE\_LOGIN\_NOTIFY |
| `61` | ADD\_UPDATE\_LOGIN\_NOTIFY |
| `62` | EDIT\_RESOURCE\_NOTIFY |
| `63` | EDIT\_RESOURCE\_REJECT |
| `64` | EDIT\_RESOURCE\_ACCEPT |
| `65` | DELETE\_RESOURCE\_NOTIFY |
| `66` | DELETE\_RESOURCE\_REJECT |
| `67` | DELETE\_RESOURCE\_ACCEPT |
| `68` | NEW\_RESOURCE\_ACCEPT |
| `69` | NEW\_RESOURCE\_REJECT |
| `7` | NEW\_USER\_EMAIL |
| `70` | NEW\_RESOURCE\_NOTIFY |
| `71` | EDIT\_GROUP\_NOTIFY |
| `72` | EDIT\_GROUP\_ACCEPT |
| `73` | EDIT\_GROUP\_REJECT |
| `74` | NEW\_GROUP\_NOTIFY |
| `75` | NEW\_GROUP\_ACCEPT |
| `76` | NEW\_GROUP\_REJECT |
| `77` | DELETE\_GROUP\_NOTIFY |
| `78` | DELETE\_GROUP\_ACCEPT |
| `79` | DELETE\_GROUP\_REJECT |
| `8` | NEW\_PENDING\_REQUEST |
| `80` | NEW\_ROLE\_NOTIFY |
| `81` | NEW\_ROLE\_ACCEPT |
| `82` | NEW\_ROLE\_REJECT |
| `83` | EDIT\_ROLE\_NOTIFY |
| `84` | EDIT\_ROLE\_ACCEPT |
| `85` | EDIT\_ROLE\_REJECT |
| `86` | DELETE\_ROLE\_NOTIFY |
| `87` | DELETE\_ROLE\_ACCEPT |
| `88` | DELETE\_ROLE\_REJECT |
| `89` | NEW\_ORGANIZTION\_NOTIFY |
| `9` | REQUEST\_REJECTED |
| `90` | NEW\_ORGANIZTION\_ACCEPT |
| `91` | NEW\_ORGANIZTION\_REJECT |
| `92` | EDIT\_ORGANIZTION\_NOTIFY |
| `93` | EDIT\_ORGANIZTION\_ACCEPT |
| `94` | EDIT\_ORGANIZTION\_REJECT |
| `95` | DELETE\_ORGANIZATION\_NOTIFY |
| `96` | DELETE\_ORGANIZATION\_ACCEPT |
| `97` | DELETE\_ORGANIZATION\_REJECT |
| `98` | ADD\_GROUP\_TO\_GROUP\_NOTIFY |
| `99` | ADD\_GROUP\_TO\_GROUP\_APPROVED |
| `ACCESS_CERTIFICATION_ACCEPTED` | ACCESS\_CERTIFICATION\_APPROVED |
| `ACCESS_CERTIFICATION_REJECTED` | ACCESS\_CERTIFICATION\_REJECT |
| `ACCESS_CERT_REMINDER` | ACCESS\_CERT\_REMINDER |
| `CERT_COMPLETE_REPORT` | CERTIFICATION\_COMPLETE\_REPORT |
| `ESCALATE_TASK_ACCESS_CERT_TASK` | ESCALATE\_TASK\_ACCESS\_CERT\_TASK |
| `ESC_UAR_TASK_CONSOLIDATED` | ESC\_UAR\_TASK\_CONSOLIDATED |
| `INVITE_USER` | USER\_ACCEPTED\_INVITE\_NOTIFY |
| `MANUAL_TASK_APPROVED` | MANUAL\_TASK\_APPROVED |
| `MANUAL_TASK_NOTIFY` | MANUAL\_TASK\_NOTIFY |
| `NOTIFICATION_ON_RECON_FINISH` | NOTIFICATION\_ON\_RECONCILIATION\_FINISH |
| `OTP_CODE` | OTP\_CODE |
| `PASSWORD_HAS_BEEN_COMPROMISED` | PASSWORD\_HAS\_BEEN\_COMPROMISED |
| `REQUEST_COMMENT_ADDED` | REQUEST\_COMMENT\_ADDED |
| `SOD_VIOLATION_DIGEST` | SOD\_VIOLATION\_DIGEST |
| `SOD_VIOLATION_HARD` | SOD\_VIOLATION\_HARD |
| `SOD_VIOLATION_RESOLVED` | SOD\_VIOLATION\_RESOLVED |
| `SOD_VIOLATION_SOFT` | SOD\_VIOLATION\_SOFT |
| `UAR_CAMPAIGN_COMPLETED` | UAR\_CAMPAIGN\_COMPLETED |
| `UAR_CAMPAIGN_DELETED` | UAR\_CAMPAIGN\_DELETED |
| `UAR_CAMPAIGN_EXPIRED` | UAR\_CAMPAIGN\_EXPIRED |
| `UAR_DELEGATED_TASK` | UAR\_DELEGATED\_TASK |
| `UAR_REVIEWER_CAMPAIGN_COMPLETE` | UAR\_REVIEWER\_CAMPAIGN\_COMPLETE |
| `USER_FILLED_OUT_INFO` | USER\_FILLED\_OUT\_INFO |
## `ACCESS_CERTIFICATION_NOTIFY`: the reviewer's "you have a campaign" email
This is the template a reviewer receives when a certification campaign is executed, and it is the one people cannot find, because it has been renamed twice. Template ID `160` shipped originally as `ACCESS_CERTIFICATION_REMINDER`, was renamed to **`ACCESS_CERTIFICATION_NOTIFY`** as of `4.2.1.7`, and had its caption and body replaced wholesale as of `4.2.2.0`, which also set `TYPE_ID = 'ACCESS_CERT_TEMPLATE'`. Search for the old name and you will find nothing. Confirm which name your deployment carries by opening **Administration → Mail Template Editor** and searching on ID `160` rather than on either name.
Do not confuse it with its three siblings, all rewritten in the same release: `ACCESS_CERT_REMINDER` (the nag sent while the campaign is open), `ESCALATE_TASK_ACCESS_CERT_TASK` and `UAR_REQUEST_EXPIRED`.
### Its notification parameters
OpenIAM sends this notification once per reviewer when a campaign is executed, and supplies exactly four parameters, plus the recipient:
| Parameter | Value the sender puts in it |
| --------------- | -------------------------------------------------------------------------------------------------------- |
| `CAMPAIGN_NAME` | The certification's name |
| `CAMPAIGN_ID` | The campaign identifier, whole and unmodified |
| `TO_DATE` | Completion deadline formatted `MM/dd/yyyy`, or the literal `anytime` when no **Days to complete** is set |
| `NUMBER_OF` | Count of users this one reviewer has to certify |
| `user` | The recipient's user record, so `${user.getDisplayName()}` resolves |
The template that actually gets sent is whichever one the campaign names on its own configuration, so a campaign configured with a custom template will not use `ACCESS_CERTIFICATION_NOTIFY` at all — check the campaign before you edit the template. Any parameter the body references beyond the five above renders empty. To confirm the parameter set on a real send, execute a campaign against a test reviewer and read the delivered mail: an empty space where you expected a value is a parameter this list does not contain.
### The link a reviewer must receive
Get this wrong and the reviewer's email arrives with a dead button. The shipped form is a **path segment** inside a `frameURL` query parameter — not a `campaignId=` query parameter:
{% code overflow="wrap" %}
```html
Link
```
{% endcode %}
That is the body as shipped since `4.2.2.0`. Three things to change in every deployment: replace `http://localhost.openiam.com` with your own host, replace the `department.it.security@openiam.com` mailto address further down the same body, and — if your reviewers work in the current interface — repoint the path to `/selfservice-v2/uar/campaigns/`. **Keep the campaign id as a path segment either way**; a button carrying `campaignId=` will not open the campaign.
{% hint style="warning" %}
**The shipped path has no `-v2` segment, so it opens the previous reviewer screen.** Nothing since `2026.6.1.0` has repointed it. If you have moved reviewers to the current interface, this template sends them to the old one. See [What your reviewers see](/administration-guide/governance/certification/the-reviewer-experience.md).
{% endhint %}
Verify by executing a campaign against your own account and clicking the button in the mail you receive — a landing page that shows the campaign is the only proof that matters.
{% hint style="warning" %}
**A reported truncated campaign ID could not be reproduced against this build.** A community report describes `${req.getNotificationParam('CAMPAIGN_ID').getValueObj()}` rendering a five-character fragment — `campaignId=nBUGE` rather than the full 32-character identifier — after which the reviewer cannot open the task. Checked against this release: the two expression forms `.valueObj` and `.getValueObj()` are interchangeable and neither truncates anything, a notification parameter holds whatever value it was given with no length limit, OpenIAM passes the campaign identifier into the parameter unaltered, and the shipped link has no `campaignId=` parameter to truncate in the first place. None of the three could shorten the value on this build.
A `campaignId=` query parameter in a reviewer's email therefore indicates a **hand-edited template**, and the fix is to restore the shipped path-segment form above. Do not adopt the accessor change as general advice — the two forms are equivalent, and swapping one for the other fixes nothing. See [Configure the review workflow](/administration-guide/governance/certification/configure-the-review-workflow.md#access_certification_notify-and-the-reviewers-link) for the one place in this release where a campaign ID *is* derived by string surgery.
{% endhint %}
## Template variables
A template body is Freemarker. Values are supplied by the sending service as notification parameters, read with `${req.getNotificationParam("")?.valueObj}`. The parameter names a template may use are declared alongside it in `MAIL_TEMPLATE_PROPERTIES`; a name that is not declared for that template resolves to null and silently renders as empty.
Test a customised template by triggering the real feature, not by previewing it — the parameter set only exists on the real send path.
*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/administration-guide/reference/shipped-mail-templates.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.