> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/action-allow-list.md).

# Action Allow List

Restrict which users can delete, complete, or change the due dates of access reviews, independent of their assigned Veza role.

The Action Allow List restricts sensitive review operations to specific users and groups, independent of their assigned Veza role. It governs four actions:

* **Delete an In Progress review**
* **Modify the due date of an In Progress review**
* **Manually complete a review**
* **Delete an expired or completed review**

Each action is governed independently, and the allow list must be enabled for any restriction to take effect. See [How It Works](#how-it-works) for the exact rules.

{% hint style="info" %}
The allow list is configured using the API. There is no UI for managing the list itself.
{% endhint %}

## How It Works

An action is restricted only when **both** of these are true:

1. The allow list is **enabled** (a single tenant-wide setting).
2. At least one allow-list entry exists **for that action**.

When an action is restricted, only allow-listed principals can perform it. A user qualifies if their own user ID is on the list for that action, or if any group they belong to is. Everyone else is blocked: the corresponding control (for example, **Delete** or **Edit Due Date**) is hidden in the review interface, and the equivalent API call is rejected with a permission error.

An action with no allow-list entries is not restricted, even when the feature is enabled. It continues to follow standard [role-based permissions](/4yItIzMvkpAvMVFAamTf/administration/administration/users/roles.md). Enabling the allow list does not lock down every action; it only activates the entries you have configured.

Two actions have additional behavior:

* **Manually complete a review** restricts only the explicit **Complete Review** action. Automatic completion (the auto-complete job, completion when the last row is signed off, and due-date advancement) is not affected.
* **Delete an expired or completed review** is only possible when the allow list is enabled. While the allow list is disabled, expired and completed reviews cannot be deleted at all; enabling the list and adding an entry for this action grants deletion to the allow-listed principals.

**Draft reviews are not affected.** Disabling the allow list restores standard role-based behavior immediately. No entries are removed, so the list persists if you re-enable it later.

## Role Requirements

| Operation                         | Required Role                     |
| --------------------------------- | --------------------------------- |
| Enable or disable the allow list  | `admin`                           |
| Add or remove users from the list | `admin` or `access_reviews_admin` |

When an action is not restricted, the standard [role-based permissions](/4yItIzMvkpAvMVFAamTf/administration/administration/users/roles.md) apply. By default, users with the `admin`, `operator`, or `access_reviews_admin` role can delete In Progress reviews and modify their due dates, and any user who can complete a review can also complete it manually. Deleting an expired or completed review is not possible at all unless the allow list is enabled with an entry for that action.

## Enable the Action Allow List

To check the current state:

```bash
curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN'
```

Returns `{"enabled": true}` or `{"enabled": false}`.

To enable:

```bash
curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"enabled": true}'
```

To disable:

```bash
curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"enabled": false}'
```

## Add Users and Groups to the Allow List

{% hint style="warning" %}
The endpoint for managing list entries (`/api/private/workflows/access/action_allowlist`) is different from the settings endpoint used to enable or disable the allow list (`/api/private/workflows/access/settings/action_allowlist_enabled`). Sending a principals payload to the settings endpoint will not add entries to the list.
{% endhint %}

Both individual users and Veza groups can be added to the allow list. A user is permitted if their user ID is directly on the list, or if any group they belong to is on the list.

All IDs must be Veza internal UUIDs — not email addresses or usernames.

To find a user's UUID:

* **Administration console**: Go to **Administration** > **Users**, click the user's name, and copy the UUID from their profile page.
* **Users API**: Use the [Users and Teams API](/4yItIzMvkpAvMVFAamTf/developers/api/users-teams.md) to retrieve users and locate the `id` field in the response.

To find a group's UUID:

* **Administration console**: Go to **Administration** > **Group Management**. The group UUID is not shown in the table view — use the API to retrieve it.
* **Groups API**: Use `GET /api/private/groups` to list groups and locate the `id` field for the target group.

```bash
curl -L -X GET 'https://your-organization.vezacloud.com/api/private/groups' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN'
```

Use the `filter` query parameter to narrow results by name: `?filter=name eq 'Your Group Name'`.

Set `allowed_action` to one or more of the four governed actions: `DELETE_IN_PROGRESS_REVIEW`, `MODIFY_IN_PROGRESS_REVIEW_DUE_DATE`, `MANUALLY_COMPLETE_REVIEW`, or `DELETE_EXPIRED_COMPLETED_REVIEW`.

**Add a user:**

```bash
curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "principals": [{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}],
    "allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
  }'
```

**Add a group:**

```bash
curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "principals": [{"type": "GROUP", "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901"}],
    "allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
  }'
```

**Remove a user or group:**

```bash
curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist:delete' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "principals": [{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}],
    "allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
  }'
```

**List all permitted principals:**

```bash
curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
  -H 'Authorization: Bearer YOUR_SECRET_TOKEN'
```

## API Reference

For the complete API reference including request and response schemas, see [Action Allow List](/4yItIzMvkpAvMVFAamTf/developers/api/workflows/access-review-settings/actionallowlist.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/action-allow-list.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.