Global Settings APIs

API operations for customizing the behavior and functionality of Veza Access Reviews.

These endpoints can be called by providing a Veza admin user API key. See Authentication to generate a bearer token for use in requests. Note that API operations in the private namespace are subject to change as features are added or modified.

Use these APIs to configure global settings for Veza Access Reviews.

At present, the settings that can be configured by a Veza administrator are:

• Auto-completion: Automatically complete reviews once all rows have a signed-off decision, or a non-rejected signed-off decision.

• Completion requirements: Enable review completion at any time, or only when all rows are signed off with a non-rejected decision.

• Data Source Status Acknowledgement: Require review creators to view and acknowledge the data source status shown at review creation.

• Overdue Review Expiration: Enable or disable expiration of overdue reviews.

• Review Expiration Behavior: Reject and sign off incomplete rows when a review expires.

• Self Review Prevention: Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.

• Column Customization: Configure default columns which reviewers will see when they open a review.

• UI Customization: Set whether notes are required when approving or rejecting access.

• Sort Order: Set the default sort order and sorting column when opening a review.

• Predefined Decision Notes: Add suggested notes as menu options when reviewers approve or reject rows.

For each endpoint, a GET request returns the current setting, and a PUT request updates the setting. Use your unique Veza URL and API key in your request, for example:

```bash
curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/cert_completion_settings' \
-H 'authorization: Bearer mZ1eqKMACtP...'
-d '{"value": "AUTO_COMPLETE_DISABLED"}

Optionally, you can use the Postman collection linked below to customize Access Reviews global settings:

46KB

access-reviews-global-settings.postman_collection.json

Review Completion Allowed Settings

Customize the requirements for completing a review.

Example:

{
    "value": "COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION"
}

An Admin or Operator user can complete a review by clicking the "Complete Review" button.

Once a review is marked as "completed," it becomes read-only and is no longer visible to reviewers. By default, a review can be completed when all rows have a signed-off decision.

This API allows you to modify this behavior, enabling a review to be completed at any time, or only when all rows are signed off with a non-rejected decision. The latter option is useful if your organization prefers to complete reviews only after all rejected access has been remediated.

Possible values are:

• COMPLETION_ALLOWED_UNKNOWN = 0

• COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION = 1 (Review can be completed only when all result rows have a decision)

• COMPLETION_ALLOWED_ANYTIME = 2 (Review can be completed any time)

Get Review Completion Allowed Settings

Get Completion Allowed Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/cert_completion_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/cert_completion_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Completion Allowed Settings

Set Certification Completion Allowed Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/cert_completion_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/cert_completion_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<integer>"
    }),
});
const data = await response.json();

Review Auto-Complete Settings

Enable or disable the "auto-complete" feature. When auto-complete is enabled, a review will automatically be completed once all rows have a signed-off decision, or a non-rejected signed-off decision, depending on the "Completion Allowed Settings."

Possible values are:

• AUTO_COMPLETE_UNKNOWN

• AUTO_COMPLETE_ENABLED

• AUTO_COMPLETE_DISABLED

Example:

{
    "value": "DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN"
}

Get Review Auto-Complete Settings

Get Auto-Complete Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/cert_auto_complete_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/cert_auto_complete_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Auto-Complete Settings

Set Auto-Complete Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/cert_auto_complete_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/cert_auto_complete_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<integer>"
    }),
});
const data = await response.json();

Self Review Prevention

Enable or disable self-review prevention. When self-review prevention is enabled, users are prevented from being assigned as reviewers for rows that relate to their own access and permissions.

The value can be:

• SELF_REVIEWER_CHECKING_UNKNOWN = 0

• SELF_REVIEWER_CHECKING_DISABLED = 1

• SELF_REVIEWER_CHECKING_ENABLED = 2

{
    "value": "SELF_REVIEWER_CHECKING_DISABLED"
}

Get Self-Reviewer Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/self_reviewer_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/self_reviewer_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Self-Reviewer Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/self_reviewer_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/self_reviewer_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<integer>"
    }),
});
const data = await response.json();

Review UI Customizations

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Example:

{
    "value": {
        "diff_dropdown_behavior": "ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE",
        "accept_notes_behavior": "NO_POP_UP",
        "reject_notes_behavior": "POP_UP_REQUIRED",
        "approve_and_sign_off_button_behavior": "SHOW"
    }
}

accept_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

reject_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

approve_and_sign_off_button_behavior can be:

• HIDE_OR_SHOW_BEHAVIOR_UNKNOWN = 0

• SHOW = 1

• HIDE = 2

Get Review Customization Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/ui_customization_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/ui_customization_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Customization Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/ui_customization_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/ui_customization_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": {
        "diff_dropdown_behavior": "<integer>",
        "accept_notes_behavior": "<integer>",
        "reject_notes_behavior": "<integer>",
        "approve_and_sign_off_button_behavior": "<integer>"
      }
    }),
});
const data = await response.json();

Review Column Defaults

This API configures the default columns which reviewers will see when they open a review. If workflow_id is specified then the configuration will only be applied to reviews related to the particular Review Configuration identified by workflow_id.

The valid values to show entity attributes include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• path_summary.ATTR

• idp.ATTR

Where ATTR is an attribute name such as “id” or “name”.

The following column values are also valid:

• status

• abstract_permissions

• concrete_permissions

• updated_at

• notes

• reviewers

• decision

• decision_by

• decision_by_id

• decision_by_name

• decision_by_email

• decision_at

• marked_fixed_by_id

• marked_fixed_by_name

• marked_fixed_by_email

• marked_fixed_at

• signed_off_state

• signed_off_by_id

• signed_off_by_name

• signed_off_by_email

• signed_off_at

• notification_status

• automation_run_ids

• no_decision_or_decision_by

• Is_signed_off

Example:

{
  "value": {
    "default_ordered_columns": [
      "source.name",
      "source.department",
      "source.customprop_worker_status",
      "source.tags",
      "path_summary.name",
      "concrete_permissions",
      "destination.name",
      "destination.customprop_display_name",
      "reviewers"
    ]
  },
  "workflow_id": "002063d2-7898-4183-b5fb-1192758fdec7"
}

Get Review Columns

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Columns

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": {
        "default_ordered_columns": [
          "source.name",
          "source.identity_unique_id",
          "concrete_permissions",
          "idp.on_premises_distinguished_name",
          "idp.name",
          "destination.name",
          "destination.type",
          "reviewers",
          "notes",
          "decision_by",
          "decision_at",
          "notification_status",
          "automation_run_ids"
        ]
      }
    }),
});
const data = await response.json();

Get All Column Customizations

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings:list_all

Header parameters

Response

200500

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/ui_column_settings:list_all', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Review Default Sort Order

Configure the default order in which review rows are displayed. Note: Users can later sort the rows as they prefer.

The order is specified using a SCIM "order by" expression. The default value is source.type asc.

Valid values include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• idp.ATTR

Where ATTR is an attribute name such as “id” or “name”.

Example

{
    "value": {
        "order_by": "destination.name desc"
    }
}

Get Review Sort Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/view_sort_settings

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/view_sort_settings', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Sort Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/view_sort_settings

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/view_sort_settings', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": {
        "order_by": "<string>"
      }
    }),
});
const data = await response.json();

Expire Overdue Reviews

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be “expired” when it becomes overdue. An expired review is read-only and is not shown to reviewers.

The value can be True or False.

Get Expire Overdue Certifications Setting

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/expire_overdue_certifications

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/expire_overdue_certifications', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Expire Overdue Certifications Setting

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/expire_overdue_certifications

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/expire_overdue_certifications', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<boolean>"
    }),
});
const data = await response.json();

Review Expiration Behavior

This setting is configurable on the Access Reviews > Settings page. Enable Reject incomplete rows to reject and sign off on undecided rows when a review expires.

This API allows you to change the behavior when a review expires (which can be enabled in Review Auto-Complete Settings). Depending on the behavior, incomplete rows can be auto-rejected when the review deadline passes.

Possible values are:

• DO_NOTHING: No action is made on incomplete rows (default).

• AUTO_REJECT_INCOMPLETE_RESULTS: Reject and sign-off any results that are incomplete when the review expires.

Review expiration behavior can be configured globally, or for all reviews for a single Review, specified by workflow_id in the request.

Get Review Expiration Behavior

Get Review Expiration Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/review_expiration_behavior

Query parameters

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/review_expiration_behavior', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Review Expiration Behavior

Set Review Expiration Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/review_expiration_behavior

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/review_expiration_behavior', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<integer>",
      "workflow_id": "<string>"
    }),
});
const data = await response.json();

Data Source Acknowledgement Settings

By default, when a review is created, a user can optionally view the status of the data sources involved in the review. This API allows the behavior to change, requiring that the data source status is shown to the user and acknowledged during review creation.

Possible values are:

• DATASOURCE_ACKNOWLEDGEMENT_UNKNOWN = 0

• DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN = 1

• DATASOURCE_ACKNOWLEDGEMENT_REQUIRED = 2

Get Data Source Acknowledgement Settings

GEThttp://{{baseurl}}/api/private/workflows/access/global_settings/datasource_acknowledgement

Header parameters

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/datasource_acknowledgement', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Set Data Source Acknowledgement Settings

PUThttp://{{baseurl}}/api/private/workflows/access/global_settings/datasource_acknowledgement

Header parameters

Body

application/json

object

Response

200

OK

Body

application/json

object

Request

JavaScriptCurlPython

const response = await fetch('http://{{baseurl}}/api/private/workflows/access/global_settings/datasource_acknowledgement', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "value": "<integer>"
    }),
});
const data = await response.json();

Predefined Decision Notes

Configure predefined notes as menu options when reviewers approve or reject rows. This feature can be configured globally for all reviews or specifically for individual review configurations. When configured for a specific review configuration (using workflow_id), those settings override any global predefined notes.

The predefined notes appear as selectable options in the notes dialog when making decisions, suggesting standardized responses alongside free-form text entry.

Example request body:

{
    "value": {
        "reject_notes": [
            "Rotate now",
            "Delete secret"
        ],
        "accept_notes": []
    },
    "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"  // Optional
}

The request body accepts:

• reject_notes: Array of predefined note options shown when rejecting rows

• accept_notes: Array of predefined note options shown when approving rows

• workflow_id: (Optional) Specific review configuration ID to override global settings

Get Predefined Notes Settings

Retrieve the current predefined notes settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Authorization: Bearer YOUR_API_KEY'

Configuration-Specific Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'

Example response:

{
    "value": {
        "reject_notes": [
            "Rotate now",u
            "Delete secret"
        ],
        "accept_notes": []
    }
}

Set Predefined Notes Settings

Update the predefined notes settings globally or for a specific review configuration.

Configuration-Specific Request:

curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
    "value": {
        "reject_notes": [
            "Rotate now",
            "Delete secret"
        ],
        "accept_notes": []
    },
    "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'