> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/developers/api/management/provider-management.md). # Provider Management API Unified API for managing all provider configurations The Provider Management API provides a consolidated interface for managing all types of integration configurations in Veza. These endpoints work across all supported integration types including AWS, Azure, Google Cloud, Snowflake, and other providers. Use these endpoints to: * Create providers of any supported type * List all providers across all types with filtering and pagination * Update common provider fields (name, labels, owners, data\_plane\_id) * Delete provider configurations {% hint style="info" %} Create requests carry type-specific configuration in the `vendor` object (see [Create a Provider](#create-a-provider)). To update type-specific settings after creation, use the [Provider-Specific APIs](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md). {% endhint %} ## Create a Provider Create an integration of any supported type with a single request. Veza also provides per-type creation endpoints (such as `POST /api/v1/providers/aws`); both the generic and per-type endpoints are available. {% openapi src="/files/Aco9gj4MY2XoNiD4zIjr" path="/api/v1/providers" method="post" %} [openapi.yaml](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4b206f2094b4c83c1def519507ce023e9ae33cd5%2Fopenapi.yaml?alt=media) {% endopenapi %} You need an API token with the `admin`, `provider_manager`, or `integration_owner` role. See [API Authentication](/4yItIzMvkpAvMVFAamTf/developers/api/authentication.md). ### Request body Send the provider object directly as the request body; it is not wrapped in a `value` field. Common fields sit at the top level, and the type-specific configuration goes in the `vendor` object. | Field | Required | Description | | --------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------- | | `name` | Yes | Display name for the integration. | | `type` | Yes | Provider type, such as `AWS` or `DATABRICKS`. Determines the expected contents of `vendor`. | | `data_plane_id` | Yes | [Insight Point](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point.md) ID that collects data for this integration. | | `vendor` | Yes | Type-specific configuration such as credentials, regions, and filters. Its fields depend on `type`. | | `owners` | No | Veza user or group IDs to assign as owners. | | `labels` | No | Metadata labels, such as `production`. | {% hint style="info" %} Enum values inside `vendor` are supplied by name. For example, AWS `credentials_type` accepts `STATIC`, `EC2_INSTANCE_PROFILE`, `ASSUME_CUSTOMER_ROLE`, or `ECS_TASK_ROLE`. {% endhint %} {% hint style="warning" %} Veza ignores unrecognized fields inside `vendor` instead of rejecting them. A misspelled field name returns `200` with that setting silently dropped, so check the created integration's configuration if it does not behave as expected. {% endhint %} ### Choosing a data plane (Insight Point) `data_plane_id` selects the [Insight Point](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point.md) that collects data for the integration. Every Veza tenant has a built-in managed Insight Point, "(default) Veza Insight Point", with the same ID in every tenant: `a2e32a80-9d64-4725-b4a9-8de6ffd0682b`. It runs inside the Veza control plane, so use it only for sources reachable from the public internet. On-premises and private-network sources need a self-hosted Insight Point that can reach them. To find a self-hosted Insight Point's ID, read the `data_plane_id` of an existing integration returned by [List All Providers](#list-all-providers), or check its configuration in the Veza UI. Some options require a self-hosted Insight Point regardless of the source: the AWS `EC2_INSTANCE_PROFILE` and `ECS_TASK_ROLE` credential types (the Insight Point runs in the target AWS environment and supplies the role), and [external secrets vaults](#using-an-external-secrets-vault) (the Insight Point needs connectivity to the vault). ### Supported provider types {% hint style="info" %} The types and payloads on this page are current as of publication. More integrations move to the generic endpoint over time, so treat this as a snapshot rather than an exhaustive or authoritative list. The API itself is the source of truth. For the per-type `vendor` field definitions, see [Cloud Platforms and Data Providers](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md). {% endhint %} The generic endpoint accepts every integration type registered in Veza's provider configurator. This page shows `vendor` payloads for `AWS`, `AZURE`, `DATABRICKS`, `ORACLE_CLOUD`, `SQL_SERVER`, and `TRINO`. Other registered types work the same way, including `POSTGRESQL`, `MYSQL`, `CASSANDRA`, `ELASTICSEARCH`, `ORACLE_DB`, `SAP_ECC`, `CYBERARK`, and `PING_ONE`. For their `vendor` fields, see the type-specific object schemas in [Cloud Platforms and Data Providers](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md). A request for a type that is not registered returns a `provider type ... is not supported` error. Google Cloud, Okta, OneLogin, Snowflake, and Active Directory currently use their own per-type endpoints. Create them there. See [Creating other integration types](#creating-other-integration-types). ### Example: create an AWS integration ```bash curl -X POST \ "https://{tenant}.vezacloud.com/api/v1/providers" \ -H "Authorization: Bearer {your_api_key}" \ -H "Content-Type: application/json" \ -d '{ "name": "AWS Production", "type": "AWS", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "vendor": { "credentials_type": "ASSUME_CUSTOMER_ROLE", "account_id": "123456789012", "assume_role_name": "VezaDiscoveryRole", "assume_role_external_id": "veza-external-id", "regions": ["us-east-1", "us-west-2"] }, "labels": ["production"] }' ``` For static credentials, set `"credentials_type": "STATIC"` and provide `access_key_id` and `secret_key` instead of the assume-role fields. ### Vendor payloads by type The `vendor` object for each supported type, shown as examples current as of publication. Combine one of these with the top-level `name`, `type`, and `data_plane_id` fields shown above. For the full `vendor` field definitions per type, see the [Cloud Platforms and Data Providers](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md) reference. {% tabs %} {% tab title="AWS" %} ```json { "credentials_type": "ASSUME_CUSTOMER_ROLE", "account_id": "123456789012", "assume_role_name": "VezaDiscoveryRole", "assume_role_external_id": "veza-external-id", "regions": ["us-east-1", "us-west-2"] } ``` {% endtab %} {% tab title="Azure" %} ```json { "tenant_id": "12345678-1234-1234-1234-123456789012", "client_id": "87654321-4321-4321-4321-210987654321", "client_secret": "your-client-secret", "services": ["AZUREAD", "SHAREPOINT", "SQLSERVER"] } ``` {% endtab %} {% tab title="Databricks" %} ```json { "host": "https://dbc-a1b2c3d4-e5f6.cloud.databricks.com", "authentication_method": "PAT", "token": "dapiXXXXXXXXXXXXXXXXXXXXXXXX", "cluster_http_endpoint": "/sql/1.0/warehouses/abcd1234efgh5678" } ``` {% endtab %} {% tab title="Oracle Cloud" %} ```json { "user_ocid": "ocid1.user.oc1..aaaaexampleuser", "tenancy_ocid": "ocid1.tenancy.oc1..aaaaexampletenancy", "fingerprint": "12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef", "region": "us-ashburn-1", "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----" } ``` {% endtab %} {% tab title="SQL Server" %} ```json { "host": "sqlserver.company.com", "port": 1433, "username": "veza_user", "password": "your-password", "database_allow_list": ["ProductionDB", "AnalyticsDB"] } ``` {% endtab %} {% tab title="Trino" %} ```json { "host": "trino.company.com", "port": 8080, "username": "veza_user", "password": "your-password", "aws_s3_object_config": { "credentials_type": "STATIC", "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "your-secret-key", "region": "us-east-1", "bucket": "trino-metadata-bucket", "object": "cluster-metadata.json" } } ``` Trino requires `aws_s3_object_config`. Its `credentials_type` must be `STATIC`, `ASSUME_CUSTOMER_ROLE`, or `EC2_INSTANCE_PROFILE`. Note that `ECS_TASK_ROLE` is not accepted here, unlike top-level AWS. `ASSUME_CUSTOMER_ROLE` replaces the access keys with `account_id`, `assume_role_name`, and `assume_role_external_id`. `EC2_INSTANCE_PROFILE` needs only `region`, `bucket`, and `object`. {% endtab %} {% endtabs %} For the full set of optional fields per type, such as service selection and resource filtering, see the type-specific object schemas in [Cloud Platforms and Data Providers](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md). ### Authentication methods Several types support more than one authentication method. Set the `vendor` fields for the method you use: | Type | Methods (`vendor` fields) | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AWS | `credentials_type`: `ASSUME_CUSTOMER_ROLE` (`assume_role_name`, `assume_role_external_id`), `STATIC` (`access_key_id`, `secret_key`), or `EC2_INSTANCE_PROFILE` / `ECS_TASK_ROLE` (no stored keys; requires a self-hosted Insight Point running in the target AWS environment). | | Azure | Client secret (`client_secret`) or certificate (`auth_certificate`, `auth_certificate_password`). | | Databricks | `authentication_method`: `PAT` (`token`) or `EXTERNAL_OAUTH` (the `external_oauth_*` fields). | | Snowflake | `authentication_method`: `BASIC` (`password`), `KEY_PAIR` (`private_key`, `private_key_password`), `EXTERNAL_OAUTH`, or `EXTERNAL_OAUTH_CLIENT_CREDENTIALS` (`external_oauth_token_endpoint`, `external_oauth_client_id`, `external_oauth_client_secret`, `external_oauth_audience`, and optionally `external_oauth_scope`). | | Okta | `credentials_type`: `API_TOKEN` (`token`) or `OAUTH` (`client_id`, `private_key_id`, `private_key`). | | Active Directory | `username` and `password`; set `kerberos_auth: true` to bind over Kerberos. | Oracle Cloud authenticates with an API signing key (`user_ocid`, `tenancy_ocid`, `fingerprint`, `private_key`). SQL Server and Trino authenticate with `username` and `password`. ### Using an external secrets vault Instead of sending credentials inline, you can store them in an external secrets vault and reference them from the request. Add a `secret_references` array at the top level of the provider object. A provider can have one provider-level secret reference, so store every credential the integration needs in a single vault secret: ```json "secret_references": [ { "secret_id": "prod-azure-credentials", "vault_id": "", "secret_mapping": { "type": "JSON" } } ] ``` With `type: JSON`, the default, the vault secret must itself be a JSON object whose keys are the vendor field names Veza should fill, for example `{"client_id": "...", "client_secret": "..."}`. Veza matches each key to a vault-eligible field, and a key with no matching field fails the extraction. With `type: SIMPLE`, the whole secret value fills one field, and `mapping` names that field, for example `{"type": "SIMPLE", "mapping": "client_secret"}`. `mapping` is required for `SIMPLE` and unused for `JSON`. Look up `vault_id` with `GET /api/v1/secretsvaults`. Only fields that opt in support vault sourcing. Among the integrations on this page: | Type | Create endpoint | Vault-eligible fields | | ---------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------- | | Azure | generic (in `vendor`) | `client_id`, `client_secret`, `auth_certificate`, `auth_certificate_password`, `m365_agents_refresh_token` | | Active Directory | `/api/v1/providers/activedirectory` | `username`, `password`, `ldaps_certificate` | | Okta | `/api/v1/providers/okta` | `token`, `client_id`, `private_key_id`, `private_key` | AWS, Databricks, Oracle Cloud, SQL Server, Trino, and Google Cloud do not support external secrets vaults. Secrets Vaults is an Early Access feature and requires a self-hosted Insight Point with connectivity to the vault. For vault setup and the complete workflow, including data-source-level references, see [Using secret references via API](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/secrets-vaults/secret-references-api.md). ### Creating other integration types Google Cloud, Okta, OneLogin, Snowflake, and Active Directory currently use their own per-type endpoints rather than the generic one. Create them by posting to those endpoints. Per-type request bodies are flat: they have no `vendor` object and no `type` field, since the type is set by the path. {% tabs %} {% tab title="Google Cloud" %} `POST /api/v1/providers/google_cloud` ```json { "name": "GCP Production", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "credentials_json": "{ service account key JSON }", "workspace_email": "service-account@project.iam.gserviceaccount.com", "customer_id": "C01234567", "project_allow_list": ["prod-project-1", "prod-project-2"], "services": ["IAM", "STORAGE", "COMPUTE", "WORKSPACE", "BIGQUERY"] } ``` {% endtab %} {% tab title="Okta" %} `POST /api/v1/providers/okta` ```json { "name": "Okta Production", "domain": "your-org.okta.com", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "token": "00XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" } ``` {% endtab %} {% tab title="OneLogin" %} `POST /api/v1/providers/onelogin` ```json { "name": "OneLogin Production", "domain": "your-org.onelogin.com", "region": "us", "client_id": "your-client-id", "client_secret": "your-client-secret", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b" } ``` {% endtab %} {% tab title="Snowflake" %} `POST /api/v1/providers/snowflake` ```json { "name": "Snowflake Production", "account_locator": "xy12345", "region": "us-east-1", "cloud": "aws", "user": "veza_user", "password": "your-password", "role": "VEZA_ROLE", "warehouse": "COMPUTE_WH", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b" } ``` {% endtab %} {% tab title="Active Directory" %} `POST /api/v1/providers/activedirectory` ```json { "name": "AD Production", "host": "dc1.corp.example.com", "port": 636, "username": "veza-service", "password": "your-password", "domains": ["corp.example.com"], "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b" } ``` {% endtab %} {% endtabs %} Google Cloud and Snowflake also have full object schemas in [Cloud Platforms and Data Providers](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md). For setup prerequisites, see the [integration guides](/4yItIzMvkpAvMVFAamTf/integrations/integrations.md). ## List All Providers Returns a list of all configured providers across all types. Supports filtering, sorting, and pagination. {% openapi src="/files/Aco9gj4MY2XoNiD4zIjr" path="/api/v1/providers" method="get" %} [openapi.yaml](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4b206f2094b4c83c1def519507ce023e9ae33cd5%2Fopenapi.yaml?alt=media) {% endopenapi %} ### Query Parameters | Parameter | Type | Description | | --------------------------- | ------- | --------------------------------------------------------------- | | `page_size` | integer | Maximum number of results per page (default: 25) | | `page_token` | string | Token for retrieving the next page of results | | `filter` | string | Filter expression (e.g., `state eq 'ENABLED'`, `type eq 'AWS'`) | | `include_datasource_status` | string | Include datasource status in response | | `include_type_summary` | boolean | Include type summary field | ### Example Request ```bash curl -X GET \ "https://{tenant}.vezacloud.com/api/v1/providers?page_size=10&filter=state+eq+'ENABLED'" \ -H "Authorization: Bearer {your_api_key}" \ -H "Accept: application/json" ``` ### Example Response ```json { "values": [ { "id": "883dd869-8762-4187-8767-1c387de14b4b", "vendor_id": "123456789012", "name": "AWS-Production", "type": "AWS", "state": "ENABLED", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "status": "SUCCESS", "external_id": "501779813173", "team_id": "team-uuid-here", "team_name": "Platform Team", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-08-26T14:22:00Z", "created_by": "user-uuid", "updated_by": "user-uuid", "owners": ["user-uuid-1", "group-uuid-1"], "labels": ["production", "critical"], "vendor": {}, "lifecycle_management_state": "NOT_CONFIGURED", "provisioning": false }, { "id": "fa04e92f-6e0d-4285-ba58-86a20c6941ff", "vendor_id": "contoso.onmicrosoft.com", "name": "Azure-Production", "type": "AZURE", "state": "ENABLED", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "status": "SUCCESS", "external_id": "veza-ext-def456", "team_id": "team-uuid-here", "team_name": "Platform Team", "created_at": "2024-02-01T09:15:00Z", "updated_at": "2024-08-26T13:45:00Z", "owners": [], "labels": ["production"], "vendor": {}, "lifecycle_management_state": "NOT_CONFIGURED", "provisioning": false } ], "next_page_token": "eyJvZmZzZXQiOjEwfQ==" } ``` {% hint style="info" %} Use `page_size` and `page_token` parameters for pagination. Continue fetching pages until `next_page_token` is empty or absent. {% endhint %} ## Update Provider (Full) Update a provider with `PUT`. Send the provider object directly as the request body, not wrapped in a `value` field. `PUT` does not infer which fields to change, so list them in an `update_mask` query parameter; fields left out of the mask stay unchanged. If you omit `update_mask` entirely, the request succeeds without changing anything. {% openapi src="/files/Aco9gj4MY2XoNiD4zIjr" path="/api/v1/providers/{value.id}" method="put" %} [openapi.yaml](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4b206f2094b4c83c1def519507ce023e9ae33cd5%2Fopenapi.yaml?alt=media) {% endopenapi %} ### Example Request ```bash curl -X PUT \ "https://{tenant}.vezacloud.com/api/v1/providers/883dd869-8762-4187-8767-1c387de14b4b?update_mask=name,data_plane_id,owners,labels" \ -H "Authorization: Bearer {your_api_key}" \ -H "Content-Type: application/json" \ -d '{ "id": "883dd869-8762-4187-8767-1c387de14b4b", "name": "AWS-Production-Updated", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "owners": ["user-uuid-1", "group-uuid-1"], "labels": ["production", "critical", "pci"] }' ``` ### Example Response ```json { "value": { "id": "883dd869-8762-4187-8767-1c387de14b4b", "vendor_id": "123456789012", "name": "AWS-Production-Updated", "type": "AWS", "state": "ENABLED", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "status": "PENDING", "external_id": "501779813173", "team_id": "team-uuid-here", "team_name": "Platform Team", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-08-26T15:30:00Z", "created_by": "user-uuid", "updated_by": "user-uuid", "owners": ["user-uuid-1", "group-uuid-1"], "labels": ["production", "critical", "pci"], "vendor": {}, "lifecycle_management_state": "NOT_CONFIGURED", "provisioning": false } } ``` ## Update Provider (Partial) Update selected fields with `PATCH`. Send the provider object directly as the request body, not wrapped in a `value` field, and include only the fields you want to change. `PATCH` infers the `update_mask` from the fields present in the body, so you do not need to send one. To override that inference, pass an explicit `update_mask` query parameter. {% openapi src="/files/Aco9gj4MY2XoNiD4zIjr" path="/api/v1/providers/{value.id}" method="patch" %} [openapi.yaml](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4b206f2094b4c83c1def519507ce023e9ae33cd5%2Fopenapi.yaml?alt=media) {% endopenapi %} ### Example Request ```bash curl -X PATCH \ "https://{tenant}.vezacloud.com/api/v1/providers/883dd869-8762-4187-8767-1c387de14b4b" \ -H "Authorization: Bearer {your_api_key}" \ -H "Content-Type: application/json" \ -d '{ "id": "883dd869-8762-4187-8767-1c387de14b4b", "name": "AWS-Production-Renamed", "labels": ["production", "updated"] }' ``` ### Example Response ```json { "value": { "id": "883dd869-8762-4187-8767-1c387de14b4b", "vendor_id": "123456789012", "name": "AWS-Production-Renamed", "type": "AWS", "state": "ENABLED", "data_plane_id": "a2e32a80-9d64-4725-b4a9-8de6ffd0682b", "status": "PENDING", "external_id": "501779813173", "team_id": "team-uuid-here", "team_name": "Platform Team", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-08-26T15:45:00Z", "owners": ["user-uuid-1", "group-uuid-1"], "labels": ["production", "updated"], "vendor": {}, "lifecycle_management_state": "NOT_CONFIGURED", "provisioning": false } } ``` {% hint style="info" %} Prefer `PATCH` for updates: it infers the fields to change from the request body. `PUT` requires an explicit `update_mask` query parameter and leaves fields unchanged if you omit it. {% endhint %} ## Delete Provider Permanently delete a provider configuration and all associated data sources. {% openapi src="/files/Aco9gj4MY2XoNiD4zIjr" path="/api/v1/providers/{id}" method="delete" %} [openapi.yaml](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4b206f2094b4c83c1def519507ce023e9ae33cd5%2Fopenapi.yaml?alt=media) {% endopenapi %} ### Example Request ```bash curl -X DELETE \ "https://{tenant}.vezacloud.com/api/v1/providers/883dd869-8762-4187-8767-1c387de14b4b" \ -H "Authorization: Bearer {your_api_key}" ``` ### Example Response Returns an empty response with HTTP status `200 OK` on success. ```json {} ``` ## Provider Response Fields ### Core Fields | Field | Type | Behavior | Description | | --------------- | ------ | ----------- | ------------------------------------------------------------------- | | `id` | string | Output-only | Unique provider identifier (UUID) | | `vendor_id` | string | Output-only | Provider-specific identifier (e.g., AWS account ID) | | `name` | string | Mutable | Display name for the provider | | `type` | string | Immutable | Provider type (AWS, AZURE, GOOGLE\_CLOUD, etc.) | | `state` | enum | Output-only | Provider state: `ENABLED`, `DISABLED`, `DELETING`, `PENDING_DELETE` | | `status` | enum | Output-only | Discovery status: `PENDING`, `SUCCESS`, `ERROR`, `UNAUTHENTICATED` | | `data_plane_id` | string | Mutable | Insight Point ID for data collection | | `external_id` | string | Output-only | External identifier for cross-system references | ### Metadata Fields | Field | Type | Behavior | Description | | ----------------- | --------- | ----------- | ---------------------------------------------- | | `created_at` | timestamp | Output-only | Creation timestamp | | `updated_at` | timestamp | Output-only | Last modification timestamp | | `created_by` | string | Output-only | User ID who created the provider | | `updated_by` | string | Output-only | User ID who last modified the provider | | `created_by_name` | string | Output-only | Display name of creator (when requested) | | `updated_by_name` | string | Output-only | Display name of last modifier (when requested) | ### Organization Fields | Field | Type | Behavior | Description | | ------------- | -------------- | ----------- | ----------------------------------------------------- | | `team_id` | string | Output-only | Owning team identifier | | `team_name` | string | Output-only | Owning team display name | | `owners` | array\[string] | Mutable | List of Veza user or group IDs with owner permissions | | `owner_names` | array\[string] | Output-only | Display names of owners | | `labels` | array\[string] | Mutable | Metadata labels (e.g., "production", "pci") | | `rbac_id` | string | Output-only | RBAC identifier for access control | ### Status Fields | Field | Type | Behavior | Description | | ------------------------------- | ------- | ----------- | ------------------------------------------ | | `extractors_datasource_status` | enum | Output-only | Aggregate status of extractor datasources | | `discoverers_datasource_status` | enum | Output-only | Aggregate status of discoverer datasources | | `lifecycle_management_state` | object | Output-only | Lifecycle Management provisioning state | | `provisioning` | boolean | Mutable | Whether Lifecycle Management is enabled | ### Vendor Configuration | Field | Type | Behavior | Description | | -------- | ------ | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `vendor` | object | Create input | Type-specific configuration (credentials, regions, filters) supplied when [creating a provider](#create-a-provider). Its fields depend on `type`. List responses return `vendor` as an empty object. | ## Error Responses All endpoints return standard HTTP status codes: | Status Code | Description | | ----------- | ---------------------------------------------------- | | 200 | Success | | 400 | Bad Request - Invalid parameters or request body | | 401 | Unauthorized - Invalid or missing API key | | 403 | Forbidden - Insufficient permissions | | 404 | Not Found - Provider does not exist | | 409 | Conflict - Provider already exists or state conflict | | 422 | Unprocessable Entity - Validation error | | 500 | Internal Server Error | ## Related Documentation * [Provider-Specific APIs](/4yItIzMvkpAvMVFAamTf/developers/api/management/providers.md) * [Data Sources API](/4yItIzMvkpAvMVFAamTf/developers/api/management/datasources.md) * [API Authentication](/4yItIzMvkpAvMVFAamTf/developers/api/authentication.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/developers/api/management/provider-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.