> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/developers/api/access-requests.md).

# Access AuthZ APIs

Automate user provisioning, access grants, and deprovisioning across enterprise applications using Veza's unified provisioning/deprovisioning REST API

### Overview

Delivered as a unified REST API, Veza Access AuthZ empowers developers and system administrators to automate last-mile provisioning and deprovisioning across diverse enterprise environments. These Access Request APIs eliminate the need to develop integrations one at a time between your systems and target applications, enabling rapid time-to-value, reduced manual errors, and strengthened identity security.

Access AuthZ works with native integrations (Active Directory, Azure AD, Okta, Snowflake, AWS), SCIM-compatible systems, and custom applications using Veza's Open Authorization API (OAA) framework. The APIs support both standalone direct access automation and integration with Veza Lifecycle Management for policy-driven access grants.

Key benefits include automated provisioning and de-provisioning to minimize attack surface, unified REST API endpoints that simplify integrations, comprehensive application support for leading platforms, and flexibility for custom and legacy applications.

Use cases span Day 1 productivity for new employees, elimination of orphaned accounts for terminated users, and just-in-time access for contractors and guest workers. The APIs follow consistent patterns whether managing direct access requests or integrating with broader lifecycle management policies.

### Get Started

The following topics can help you familiarize yourself with Access AuthZ concepts and workflows:

<table data-view="cards"><thead><tr><th align="center"></th><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td align="center"><strong>Quick Start Tutorial</strong></td><td>Learn the basics of creating and monitoring access requests with step-by-step examples.</td><td><a href="https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-af2f67f25aff4feb60d6203846c13625d9b9f010%2Fscenarios.png?alt=media">scenarios.png</a></td><td><a href="/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/quickstart.md">Quick Start</a></td></tr><tr><td align="center"><strong>Prerequisites and Setup</strong></td><td>Configure your Veza environment for Access AuthZ including integrations and permissions.</td><td><a href="https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-774ef146f45d4bd1c65e907ddf50606d0e5581b1%2Fconfiguration.png?alt=media">configuration.png</a></td><td><a href="/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/prerequisites.md">Prerequisites</a></td></tr><tr><td align="center"><strong>Frequently Asked Questions</strong></td><td>Common questions and troubleshooting guidance for Access AuthZ implementations.</td><td><a href="https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-396348445d4bf52da7c3c0e25beaa787531469b3%2Faccess.png?alt=media">access.png</a></td><td><a href="/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/faq.md">FAQ</a></td></tr></tbody></table>

## Prerequisites

Before using Access AuthZ APIs, ensure your Veza environment is properly configured. See [Prerequisites and Setup](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/prerequisites.md) for complete requirements including:

* Target integrations enabled for Lifecycle Management
* Access Requests enabled
* "Grant without approval" enabled (for automatic execution)
* An Admin token for API access

## How It Works

### Direct Access Request APIs

**Endpoint**: `POST /api/private/lifecycle_management/access_requests`

These operations allow direct operations on supported target systems without requiring a full Lifecycle Management configuration involving Policies and Access Profiles. Instead, the API request itself specifies the exact users, groups, and entitlements to modify.

For detailed API schemas and examples, see the related endpoint documentation:

* [CreateAccessRequest](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/endpoints/createaccessrequest.md) - Create access requests to grant or revoke entitlements
* [GetAccessRequest](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/endpoints/getaccessrequest.md) - Retrieve request status and monitor progress

Direct API calls work with entities in Veza's Access Graph to modify users, groups, and entitlements. Entity IDs are provided in access request responses, so you don't need to query the graph separately for automation workflows. They work with any integration that supports Lifecycle Management [Actions](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions.md).

**Supported Target Systems:**

Access AuthZ works with:

* **Native integrations**: Active Directory, Azure AD, Okta, Snowflake, AWS, and many others
* **SCIM-compatible systems**: Any application supporting SCIM v2 protocol
* **Custom applications**: Using Veza's Open Authorization API (OAA) framework

See [Target Application Support](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/integrations.md#target-application-support) for the complete list of supported integrations and target entity types.

## Basic Request Pattern

A common use case is to grant a user access to specific groups. Here is an example for a SCIM integration to add a user to a group:

**Example Request:**

```bash
curl -X POST "https://your-instance.vezacloud.com/api/private/lifecycle_management/access_requests" \
  -H "authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "request_type": "GRANT",
    "request_source": "ACCESS_REQUEST",
    "reason": "User needs access to project resources",
    "datasource_id": "0198cfaf-1f97-7698-a760-05b98833ffd3",
    "assignee_entity_type": "OAA.SCIM.User",
    "assignee_entity_id": "custom_provider:application:demo-scim:user:a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "target_entity_type": "OAA.SCIM.Group",
    "target_entity_ids": [
      "custom_provider:application:demo-scim:group:f9e8d7c6-b5a4-3210-9876-543210fedcba"
    ]
  }'
```

**Example Response:**

```json
{
  "value": {
    "id": "0198cfb4-0adb-740b-8e2d-7a7c09044996",
    "state": "PLAN_SELECTED",
    "request_type": "GRANT",
    "reason": "User needs access to project resources",
    "assignee_entity_id": "custom_provider:application:demo-scim:user:a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "assignee_entity_name": "Jane Smith",
    "assignee_entity_type": "OAA.SCIM.User",
    "target_entity_names": ["Project Team"],
    "entitlements": [
      {
        "entity_type": "OAA.SCIM.Group",
        "entity_id": "custom_provider:application:demo-scim:group:f9e8d7c6-b5a4-3210-9876-543210fedcba"
      }
    ],
    "created_at": "2025-08-22T02:50:45.123456789Z"
  }
}
```

The response includes the `assignee_entity_id` which can be used for subsequent operations on this user.

{% hint style="info" %}
**Note:** Replace the placeholder IDs (datasource\_id, assignee\_entity\_id, target\_entity\_ids) with actual IDs from your Veza instance. The [Quick Start Tutorial](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/quickstart.md) shows how to find these IDs through the APIs, and the [FAQ](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/faq.md) covers provider management APIs for discovering LCM datasources.
{% endhint %}

## Request Monitoring

Once a request is created, the job is queued and runs asynchronously. You can track the progress of the request and wait for it to complete.

Use [GetAccessRequest](/4yItIzMvkpAvMVFAamTf/developers/api/access-requests/endpoints/getaccessrequest.md) to retrieve the request status.

To monitor status, poll the request and check the state field in the response until it reaches a terminal state:

**Terminal States:**

* `COMPLETED` - Access successfully granted/revoked
* `ERRORED` - Request failed (check `error_message` field for details)
* `CANCELED` - Request was canceled
* `REJECTED` - Request was rejected
* `JIT_REVOKED` - Just-in-time access was revoked

**In-Progress States:**

* `INITIAL` - Request has been created
* `WAITING_FOR_APPROVAL` - Request awaiting approval
* `NEEDS_MORE_INFORMATION` - Approver requested more information
* `PLAN_SELECTED` - Request is processing
* `EXTERNAL_RUNNING` - External system is processing request

### API Documentation

For more information, see the rest of the Access AuthZ API documentation. Expand the section on the left navigation to view all topics.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/developers/api/access-requests.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.