Access Review Exports

Programmatic creation and download of access review exports

The Access Review Export API enables you to programmatically create, monitor, and download exports of access review results in CSV or XLSX format. These endpoints provide the same export functionality available in the Veza UI, allowing you to automate report generation and integrate review data into external systems.

Endpoints

• Create Access Review Export - Initiate a new export job

• Get Access Review Export - Check export status and metadata

• Download Access Review Export - Download the completed export file

Workflow

1. Create an export job with certification ID and format

2. Poll the status endpoint until FINISHED

3. Download the export file

Create Access Review Export

Create a new export job for an access review certification.

Request

POST /api/preview/awf/exports/access_review:create

Request Body

Field	Type	Required	Description
format	integer	Yes	Export format: 0 (CSV) or 6 (XLSX)
certification_id	string	Yes	The ID of the certification to export
previous_certification_id	string	No	Previous certification ID for diff exports
order_by	string	No	Sort order for results (e.g., "source.name ASC")
filter	string	No	SCIM filter for source/destination fields (e.g., "source.email eq \"[email protected]\"")
mutable_filter	string	No	SCIM filter for mutable fields (e.g., "decision eq \"RESULT_DECISION_REJECTED\"")
title	string	No	Title for XLSX exports (max 30 characters)

Supported Formats: Only CSV (format 0) and XLSX (format 6) are supported for access review exports.

Response

{
  "export_id": "019abd80-a80a-7601-b97d-2dfb6b3a35d1"
}

Examples

Create a CSV export:

curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "format": 0,
    "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
    "title": "Access Review Export"
  }'

Create a filtered CSV export (rejected rows only):

curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "format": 0,
    "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
    "mutable_filter": "decision eq \"RESULT_DECISION_REJECTED\"",
    "title": "Rejected Access"
  }'

Create an XLSX diff export:

curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "format": 6,
    "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
    "previous_certification_id": "a1234abc-1234-5678-9abc-def123456789",
    "title": "Access Changes"
  }'

Get Access Review Export

Retrieve the status and metadata for an export job.

Request

GET /api/preview/awf/exports/access_review/{export_id}

Path Parameters

Parameter	Type	Required	Description
export_id	string	Yes	The export ID returned from the create request

Response

{
  "value": {
    "id": "019abd80-a80a-7601-b97d-2dfb6b3a35d1",
    "state": "FINISHED",
    "created_by": "59fd8ac9-26d8-4d06-aa98-c66c2da0e822",
    "created_at": "2025-11-26T00:11:56.810394292Z",
    "updated_at": null,
    "finished_row_count": 0,
    "format": "CSV",
    "error_reason": "",
    "title": "Test Export",
    "last_completed_export": "2025-11-26T00:11:57.513887Z"
  }
}

Export Status Values

Status	Description
CREATED	Export job is queued and waiting to start
PROCESSING	Export is being generated
FINISHED	Export completed successfully and is ready for download
FAILED	Export failed due to an error
CANCELLED	Export was cancelled before completion
EXPIRED	Export file has expired and is no longer available for download

Poll the export status endpoint periodically until the status is FINISHED before attempting to download. Large exports may take several minutes to complete.

Example

curl "$VEZA_URL/api/preview/awf/exports/access_review/019abd80-a80a-7601-b97d-2dfb6b3a35d1" \
  -H "authorization: Bearer $VEZA_TOKEN"

Download Access Review Export

Download the completed export file.

Request

GET /api/preview/awf/exports/access_review/{export_id}:download

Path Parameters

Parameter	Type	Required	Description
export_id	string	Yes	The export ID of a completed export

Response

The response returns the file contents with appropriate content-type headers:

• XLSX exports: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

• CSV exports: text/csv

The export must have status FINISHED before you can download it. Attempting to download an incomplete export will result in an error.

Example

curl "$VEZA_URL/api/preview/awf/exports/access_review/019abd80-a80a-7601-b97d-2dfb6b3a35d1:download" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -o access_review_export.csv

Complete Export Script

#!/bin/bash
set -e

VEZA_URL="${VEZA_URL}"
VEZA_TOKEN="${VEZA_TOKEN}"
CERT_ID="${1}"

# Create export
EXPORT_RESPONSE=$(curl -s -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d "{\"format\": 0, \"certification_id\": \"$CERT_ID\"}")

EXPORT_ID=$(echo "$EXPORT_RESPONSE" | grep -o '"export_id":"[^"]*"' | cut -d'"' -f4)
echo "Export created: $EXPORT_ID"

# Poll for completion
while true; do
  STATUS=$(curl -s "$VEZA_URL/api/preview/awf/exports/access_review/$EXPORT_ID" \
    -H "authorization: Bearer $VEZA_TOKEN" | grep -o '"state":"[^"]*"' | cut -d'"' -f4)

  echo "Status: $STATUS"
  [ "$STATUS" = "FINISHED" ] && break
  [ "$STATUS" = "FAILED" ] && echo "Export failed" && exit 1
  [ "$STATUS" = "CANCELLED" ] && echo "Export cancelled" && exit 1
  [ "$STATUS" = "EXPIRED" ] && echo "Export expired" && exit 1
  sleep 5
done

# Download
curl -s "$VEZA_URL/api/preview/awf/exports/access_review/$EXPORT_ID:download" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -o "export_${CERT_ID}.csv"

echo "Downloaded: export_${CERT_ID}.csv"

Filter Syntax

Both filter and mutable_filter parameters use SCIM filter syntax (RFC 7644), not SQL syntax.

SCIM Operators

Operator	Description	Example
eq	Equal	source.name eq "jsmith"
ne	Not equal	decision ne "RESULT_DECISION_NONE"
co	Contains	source.name co "admin"
sw	Starts with	source.email sw "john"
ew	Ends with	source.email ew "@example.com"
gt	Greater than	source.c gt 100
ge	Greater than or equal	source.d ge 50
lt	Less than	source.c lt 100
le	Less than or equal	source.d le 50
PR	Present (not null)	source.email PR

Decision Values

For mutable_filter, the decision field accepts these enum values:

Value	Description
RESULT_DECISION_NONE	No decision made (pending)
RESULT_DECISION_ACCEPTED	Access was approved
RESULT_DECISION_REJECTED	Access was rejected
RESULT_DECISION_FIXED	Access was remediated

Filter Examples

Export pending decisions only:

{
  "format": 0,
  "certification_id": "abc123",
  "mutable_filter": "decision eq \"RESULT_DECISION_NONE\"",
  "order_by": "source.name ASC"
}

Use Case	Expression
Pending decisions	"mutable_filter": "decision eq \"RESULT_DECISION_NONE\""
Rejected access	"mutable_filter": "decision eq \"RESULT_DECISION_REJECTED\""
Accepted access	"mutable_filter": "decision eq \"RESULT_DECISION_ACCEPTED\""
Source name contains	"filter": "source.name co \"Test\""
Source email equals	"filter": "source.email eq \"[email protected]\""
Combined filter	"mutable_filter": "decision eq \"RESULT_DECISION_ACCEPTED\" and signed_off_state eq \"SIGNED_OFF\""

See Also

• List Certifications - Get certification IDs for export

• List Certification Results - View results before exporting

• Create Certification - Create certifications programmatically