> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/oaa-send-rest-payload.md).

# Send REST Payload (Insight Point Routing)

Route Send REST Payload actions through Insight Points for custom OAA integrations

### Overview

Lifecycle Management supports [four integration pathways](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/integrations.md) for custom applications. This document covers configuring the **OAA Write Framework** pathway with Insight Point routing for Send REST Payload actions.

When using the [Send REST Payload](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/send-rest-request.md) action in Lifecycle Management workflows, requests execute from the Veza control plane by default. For target APIs that are on-premises or behind a firewall, you can configure a Custom Provider (OAA integration) to route requests through an [Insight Point](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point.md) agent instead.

This configuration enables:

* **On-premises API access**: Call internal APIs that aren't accessible from the public internet
* **Network isolation**: Route requests through your own infrastructure for security compliance
* **Hybrid deployments**: Mix cloud-based and on-premises targets in the same workflow

### When to Use This Configuration

**You DO NOT need this configuration if:**

* Your target API is publicly accessible
* You're calling cloud services (SaaS APIs, webhooks)
* Your Send REST Payload actions work without selecting a data source

**You NEED this configuration if:**

* Your target API is on-premises or in a private network
* The API is only accessible from specific network locations
* You need requests to originate from an Insight Point agent

### How It Works

**Without Data Source (Default):**

```mermaid
graph LR
    CP["Veza Control Plane"] -->|HTTPS| API["Target API\n(Public/Cloud)"]
```

**With Data Source (Insight Point Routing):**

```mermaid
graph LR
    CP["Veza Control Plane"] -->|Internal| IP["Insight Point Agent"]
    IP -->|HTTPS| API["Target API\n(On-Prem)"]
```

When a Custom Provider is configured with `external_lifecycle_management_type: SEND_REST_PAYLOAD`:

1. The provider's data source appears in the Send REST Payload action's **Data Source** dropdown
2. Selecting it routes the HTTP request through the associated Insight Point
3. The Insight Point agent executes the request from within your network

### Configuration

This setting is configured via the Veza REST API. It is not currently available in the Veza UI. The provider configuration only sets up Insight Point routing—the actual request URL, HTTP method, payload, and authentication are configured per-action in the [policy editor](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/send-rest-request.md).

{% hint style="info" %}
**Insight Point Required**: You must have a deployed [Insight Point](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point.md) before configuring this feature. Find your Insight Point ID in the Veza UI at **Integrations** > **Insight Points**.
{% endhint %}

#### Create Custom Provider with Send REST Payload Support

```bash
curl -X POST "https://{VEZA_URL}/api/v1/providers/custom" \
  -H "Authorization: Bearer {API_KEY}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "On-Prem HR System",
    "custom_template": "application",
    "provisioning": true,
    "external_lifecycle_management_type": "SEND_REST_PAYLOAD",
    "data_plane_id": "{INSIGHT_POINT_ID}"
  }'
```

#### Update Existing Custom Provider

```bash
curl -X PATCH "https://{VEZA_URL}/api/v1/providers/custom/{PROVIDER_ID}" \
  -H "Authorization: Bearer {API_KEY}" \
  -H "Content-Type: application/json" \
  --data '{
    "provider": {
      "id": "{PROVIDER_ID}",
      "provisioning": true,
      "external_lifecycle_management_type": "SEND_REST_PAYLOAD"
    },
    "update_mask": {
      "paths": ["provisioning", "external_lifecycle_management_type"]
    }
  }'
```

{% hint style="warning" %}
**`data_plane_id` is set at creation and cannot be changed.** To use a different Insight Point, delete and recreate the provider.
{% endhint %}

#### Required Fields

| Field                                | Required | Description                                                                                                         |
| ------------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------- |
| `name`                               | Yes      | Display name for the Custom Provider                                                                                |
| `custom_template`                    | Yes      | OAA template type (typically `application`)                                                                         |
| `provisioning`                       | Yes      | Must be `true` to enable Lifecycle Management                                                                       |
| `external_lifecycle_management_type` | Yes      | Set to `SEND_REST_PAYLOAD` to enable routing                                                                        |
| `data_plane_id`                      | Yes      | Insight Point ID (UUID) to execute requests (create only). Find at **Integrations** > **Insight Points** in the UI. |

#### Validation Rules

* **Provisioning required**: `provisioning` must be `true` when setting `external_lifecycle_management_type`
* **No internal app name**: Cannot be used with `internal_app_name` (these are mutually exclusive)
* **No `configuration_json`**: Unlike [SCIM configuration](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/integrations/oaa-scim.md), Send REST Payload does not use `configuration_json`. Including it in the request will cause a validation error. Authentication is configured per-action using the [Authorization Header](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/send-rest-request.md) setting or [REST Auth Credentials](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/rest-auth-credentials.md).
* **Cannot change type while in use**: `external_lifecycle_management_type` cannot be changed while the provider is referenced by Provisioning Policies. Remove the provider from all policies before changing this field.

### Using in Provisioning Policies

Once configured, the Custom Provider's data source will appear in the Send REST Payload action configuration:

1. In the policy editor, add a **Send REST Payload** action
2. In the **Data Source** field, select your configured Custom Provider
3. Configure the URL, method, headers, and payload as needed
4. The request will route through the associated Insight Point

{% hint style="info" %}
The Data Source field is optional. If left empty, requests execute directly from Veza's infrastructure. Only select a data source when you need Insight Point routing.
{% endhint %}

### Combining with REST Auth Credentials

You can use [REST Auth Credentials](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/rest-auth-credentials.md) together with Insight Point routing:

* **REST Auth Credentials**: Handle authentication (OAuth2, Bearer tokens, etc.)
* **Data Source selection**: Routes the request through an Insight Point

When a Data Source is selected, both the token acquisition request and the subsequent REST request execute through the Insight Point. This means Login to Bearer and OAuth2 credential types work correctly against token endpoints that are not publicly accessible—the entire authentication flow remains within your private network.

### Troubleshooting

#### Data Source Dropdown is Empty

If no data sources appear in the Send REST Payload action's Data Source dropdown:

1. **No providers configured**: Verify you have at least one Custom Provider with `external_lifecycle_management_type: SEND_REST_PAYLOAD`
2. **Provisioning not enabled**: Check that `provisioning: true` is set on the provider
3. **No data source created**: Push an OAA payload to create a data source for the provider

#### Validation Error: "external\_lifecycle\_management\_type requires provisioning to be true"

Include `provisioning: true` in your API request along with the `external_lifecycle_management_type` field.

#### Validation Error: "data\_plane\_id: Cannot be empty"

The `data_plane_id` is required when creating a provider with `external_lifecycle_management_type: SEND_REST_PAYLOAD`. Ensure you have a deployed Insight Point and include its ID in your create request.

#### Validation Error: "cannot change external\_lifecycle\_management\_type while provider is in use by LCM"

The provider is referenced by one or more Provisioning Policies. Remove the provider from all policies before changing its `external_lifecycle_management_type`.

#### Request Fails from Insight Point

If requests fail when routed through an Insight Point:

1. **Network connectivity**: Verify the Insight Point can reach the target API
2. **Firewall rules**: Ensure outbound HTTPS is allowed from the Insight Point to the target
3. **DNS resolution**: Confirm the target hostname resolves from the Insight Point's network
4. **TLS certificates**: If the target API uses an internal or self-signed CA certificate, the Insight Point will fail with `tls: failed to verify certificate: x509: certificate signed by unknown authority`. You must add the CA certificate to the Insight Point's truststore:
   * **OVA deployment**: See [Custom Certificate Configuration](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/ova-v2.md#custom-certificate-configuration)
   * **Install script deployment**: See [Using Custom Certificates](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-install-script.md#using-custom-certificates)

{% hint style="info" %}
**Testing connectivity**: To check that the Insight Point can reach the target API, select **Test Connection** on the Send REST Payload action, with **Data Source** set to your Custom Provider data source. See [Test the connection](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/send-rest-request.md#test-the-connection).
{% endhint %}

### See Also

* [Lifecycle Management Integrations](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/integrations.md): Overview of integration pathways (Native, SCIM, OAA Write Framework, and direct REST, XML, and SQL actions)
* [Send REST Payload Action](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/send-rest-request.md): Action configuration, variable substitution, and response handling
* [REST Auth Credentials](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/rest-auth-credentials.md): Centralized authentication management for Send REST Payload actions
* [SCIM for Custom Applications](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/integrations/oaa-scim.md): Alternative LCM option using SCIM endpoints (requires `configuration_json`)
* [Insight Point](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point.md): Agent deployment, connectivity requirements, and high availability
* [Open Authorization API](/4yItIzMvkpAvMVFAamTf/developers/api/oaa.md): Custom integration development


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/oaa-send-rest-payload.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.