select i2.identity_public_id as impersonator_public_id
       , i3.identity_public_id as target_public_id
       , i.created_at
from secd.impersonator i
join secd.identity i2 on i.impersonator_id = i2.identity_id
join secd.identity i3 on i.target_id = i3.identity_id
join secd.credential c using (credential_id)
where (($1::uuid is null) or (i2.identity_public_id = $1))
and (($2::uuid is null) or (i3.identity_public_id = $2))
and c.revoked_at > $3;