Create Certification

Create a new access review certification from a workflow

Create a new access review certification from an existing workflow.

Overview

Use dynamic_information to filter certification results to specific identities at creation time. This enables you to use a broad query at the workflow level, and then scope individual reviews to certain identities when creating the certification.

Identity IDs and types are sourced from the Veza Authorization Graph and must match existing graph node values from your integrated identity providers.

Endpoint

POST /api/preview/awf/certifications

Request Body

Field	Type	Required	Description
workflow_id	string	Yes	The ID of the workflow to create a certification from
data_source	integer	No	Data source type: 0 (current), 1 (most recent snapshot), 2 (specified snapshot)
snapshot_id	integer	Conditional	Required when data_source is 2
name	string	No	Name for the certification
notes	string	No	Additional notes or context
reviewer_assignment	object	No	First-level reviewer assignment configuration
reviewer_assignment_second_level	object	No	Second-level reviewer assignment configuration
automation_ids	array	No	IDs of automations to run during creation
final_approval_level	integer	No	Final approval level required
dynamic_information	object	No	Dynamic identity filtering (see below)

Dynamic Information

The dynamic_information parameter allows you to filter certification results to specific user identities at creation time.

Field	Type	Required	Description
identities	array	Yes	List of identity objects to filter by

Identity Object

Field	Type	Required	Description
id	string	Yes	The identity ID from Veza Graph (e.g., IdP user ID)
type	string	Yes	The identity type (e.g., "OktaUser", "AzureADUser")
previous_manager_id	string	No	Previous manager ID for mover scenarios

Reviewer Assignment

The reviewer_assignment and reviewer_assignment_second_level objects configure how reviewers are assigned to certification rows.

Field	Type	Description
users_manager	boolean	Assign the user's manager as reviewer
resource_managers	boolean	Assign resource owners as reviewers
reviewers	array	List of specific users to always assign
fallback_reviewers	array	Users to assign when auto-assignment cannot determine a reviewer

Response

{
  "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10"
}

Examples

Basic Certification

Create a certification using the latest data:

curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
    "name": "Q4 2025 Access Review",
    "data_source": 0
  }'

Dynamic Filtering (Joiner/Mover/Leaver)

Use dynamic_information to scope a certification to specific identities. For mover scenarios, include previous_manager_id:

curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
    "name": "Department Transfer Review",
    "data_source": 0,
    "dynamic_information": {
      "identities": [
        {
          "id": "00u1a2b3c4d5e6f7g8h9",
          "type": "OktaUser",
          "previous_manager_id": "00umgr123456789"
        }
      ]
    }
  }'

Multi-Level Review

Create a certification with multi-level approval requirements:

curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
    "name": "High-Risk Access Review",
    "data_source": 0,
    "reviewer_assignment": {
      "resource_managers": true
    },
    "reviewer_assignment_second_level": {
      "users_manager": true
    },
    "final_approval_level": 2
  }'

Identity Types

Use the graph node type that corresponds to your integrated IdP:

Integration	Identity Type
Okta	OktaUser
Azure AD	AzureADUser
Active Directory	ActiveDirectoryUser
Google Workspace	GoogleWorkspaceUser

Identity IDs and types must match the values stored in the Veza Authorization Graph. You can find these values by querying the graph or viewing entity details in the Veza UI.

See Also

• List Workflows - Get workflow IDs

• List Certifications - View created certifications

• Workflow Parameters - Complete parameter reference