Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Duplicate an existing access review configuration under a new name, carrying over notifications, Veza Actions, and per-configuration settings.
curl -X POST "https://your-organization.vezacloud.com/api/private/workflows/access/{workflow_id}:clone" \
-H "authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "Q3 Finance Review (copy)"}'{
"workflow_id": "019ed153-9f4c-7d3c-85c9-f9d516be99c0"
}{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": false
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264" // Optional
}curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Authorization: Bearer YOUR_API_KEY'curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'{
"value": {
"allow_csv_exports": false,
"allow_pdf_exports": false
}
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": false
}
}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": false
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'{}Create a new access review certification from a workflow
Enable or disable automatic review completion once all rows have decisions.
{
"certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10"
}curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
"name": "Q4 2025 Access Review",
"data_source": 0
}'curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
"name": "Department Transfer Review",
"data_source": 0,
"dynamic_information": {
"identities": [
{
"id": "00u1a2b3c4d5e6f7g8h9",
"type": "OktaUser",
"previous_manager_id": "00umgr123456789"
}
]
}
}'curl -X POST "$VEZA_URL/api/preview/awf/certifications" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
"name": "High-Risk Access Review",
"data_source": 0,
"reviewer_assignment": {
"resource_managers": true
},
"reviewer_assignment_second_level": {
"users_manager": true
},
"final_approval_level": 2
}'{
"value": "AUTO_COMPLETE_DISABLED"
}Get pending and completed certifications for a workflow
curl '{{VEZA_URL}}/api/preview/awf/certifications?workfow_id=17ce79c7-a2e6-4baf-87ff-f386764c9659' \
-H 'authorization: Bearer '$token{
"values": [
{
"certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
"workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
"query_used": {
"raw_permissions": null,
"effective_permissions": null,
"source_node_types": {
"nodes": [
{
"node_type": "GoogleWorkspaceUser",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"required_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"avoided_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"destination_node_types": {
"nodes": [
{
"node_type": "GoogleCloudProject",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"no_relation": false,
"snapshot_id": "1690354800",
"waypoint_node_types": {
"nodes": [
{
"node_type": "GoogleCloudIamRoleBinding",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"path_summary_node_types": null,
"node_relationship_type": "CONFIGURED",
"include_all_source_tags_in_results": true,
"include_all_destination_tags_in_results": false,
"page_size": "0",
"page_token": ""
},
"name": "demo",
"notes": "",
"due_date": "2023-07-30T03:44:00Z",
"reviewers": [],
"state": "IN_PROGRESS",
"snapshot_time": "2023-07-26T07:00:00Z",
"started_at": "2023-07-27T03:44:27.260812616Z",
"query_completed_at": "2023-07-27T03:44:31.410373279Z",
"completed_at": null,
"created_by": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"completed_by": null,
"results_updated_at": "2023-07-27T03:44:31.410373665Z",
"results_updated_by": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"updated_at": "2023-07-27T03:44:31.410413829Z",
"updated_by": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"error_reason": "",
"expired_at": null,
"version": 1,
"total_result_count": 2433,
"total_complete_count": 0,
"total_rejected_count": 0,
"total_accepted_count": 0,
"total_fixed_count": 0
}
]
}{
"value": {
"diff_dropdown_behavior": "ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE",
"accept_notes_behavior": "NO_POP_UP",
"reject_notes_behavior": "POP_UP_REQUIRED",
"approve_and_sign_off_button_behavior": "SHOW"
}
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/private/workflows/access/global_settings/allow_reviewer_exports HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": true,
"allow_xlsx_exports": true
},
"workflow_id": "text"
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
PUT /api/private/workflows/access/global_settings/allow_reviewer_exports HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 108
{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": true,
"allow_xlsx_exports": true
},
"workflow_id": "text"
}{}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
POST /api/private/workflows/access/{workflow_id}:clone HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 36
{
"workflow_id": "text",
"name": "text"
}{
"workflow_id": "text"
}curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'{
"column_name_overrides": {
"source.department": "Business Unit",
"destination.name": "Application",
"concrete_permissions": "Access Level"
}
}curl -X PATCH 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-d '{
"column_name_overrides": {
"source.department": "Business Unit",
"destination.name": "Application",
"concrete_permissions": "Access Level"
}
}'curl -X PATCH 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-d '{
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264",
"column_name_overrides": {
"source.department": "Business Unit",
"destination.name": "Application"
}
}'{}curl -X DELETE 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'curl -X DELETE 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/column_name_overrides?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264&field_names=source.department&field_names=destination.name' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'{}{
"value": {
"reject_notes": [
"Rotate now",
"Delete secret"
],
"accept_notes": []
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264" // Optional
}curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Authorization: Bearer YOUR_API_KEY'curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'{
"value": {
"reject_notes": [
"Rotate now",
"Delete secret"
],
"accept_notes": []
}
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"reject_notes": [
"Rotate now",
"Delete secret"
],
"accept_notes": []
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'{
"value": {
"mandatory_for_first_level": true,
"mandatory_for_second_level": false,
"mandatory_for_third_level": false
}
}{
"value": {
"mandatory_for_first_level": true,
"mandatory_for_second_level": true,
"mandatory_for_third_level": true
}
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/mandatory_due_date_for_review_settings' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"value": {
"mandatory_for_first_level": true,
"mandatory_for_second_level": false,
"mandatory_for_third_level": false
}
}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/mandatory_due_date_for_review_settings' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264",
"value": {
"mandatory_for_first_level": true,
"mandatory_for_second_level": true,
"mandatory_for_third_level": false
}
}'Optional workflow ID to get workflow-specific settings
8ae1c414-3a76-46cb-950a-925316b3f264application/jsonOK
Require due date for first-level reviews
Require due date for second-level reviews
Require due date for third-level reviews
GET /api/private/workflows/access/global_settings/mandatory_due_date_for_review_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": {
"mandatory_for_first_level": false,
"mandatory_for_second_level": false,
"mandatory_for_third_level": false
}
}application/jsonapplication/jsonOptional workflow ID for workflow-specific settings
Require due date for first-level reviews
Require due date for second-level reviews
Require due date for third-level reviews
OK
PUT /api/private/workflows/access/global_settings/mandatory_due_date_for_review_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 166
{
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264",
"value": {
"mandatory_for_first_level": true,
"mandatory_for_second_level": false,
"mandatory_for_third_level": false
}
}OK
{}Get all workflows and certification status
Configure default grouping behavior for review rows to organize data by column values.
Configure what happens when reviews expire.
application/jsonOK
GET /api/private/workflows/access/global_settings/cert_auto_complete_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": "AUTO_COMPLETE_DISABLED"
}application/jsonapplication/json{"value":"<integer>"}OK
PUT /api/private/workflows/access/global_settings/cert_auto_complete_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 21
{
"value": "<integer>"
}OK
{
"value": "AUTO_COMPLETE_DISABLED"
}application/jsonOK
GET /api/private/workflows/access/global_settings/ui_customization_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": {
"diff_dropdown_behavior": "ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE",
"accept_notes_behavior": "NO_POP_UP",
"reject_notes_behavior": "POP_UP_REQUIRED",
"approve_and_sign_off_button_behavior": "SHOW"
}
}application/jsonapplication/json{"value":{"diff_dropdown_behavior":"<integer>","accept_notes_behavior":"<integer>","reject_notes_behavior":"<integer>","approve_and_sign_off_button_behavior":"<integer>"}}OK
PUT /api/private/workflows/access/global_settings/ui_customization_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 171
{
"value": {
"diff_dropdown_behavior": "<integer>",
"accept_notes_behavior": "<integer>",
"reject_notes_behavior": "<integer>",
"approve_and_sign_off_button_behavior": "<integer>"
}
}OK
{
"value": {
"diff_dropdown_behavior": "ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE",
"accept_notes_behavior": "NO_POP_UP",
"reject_notes_behavior": "POP_UP_REQUIRED",
"approve_and_sign_off_button_behavior": "SHOW"
}
}application/jsonOK
GET /api/private/workflows/access/global_settings/expire_overdue_certifications HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": false
}application/jsonapplication/json{"value":"<boolean>"}OK
PUT /api/private/workflows/access/global_settings/expire_overdue_certifications HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 21
{
"value": "<boolean>"
}OK
{
"value": false
}application/jsonOK
GET /api/private/workflows/access/global_settings/reviews:default_page_size HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": 100
}application/jsonapplication/jsonOK
PUT /api/private/workflows/access/global_settings/reviews:default_page_size HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 13
{
"value": 100
}OK
{}curl '{{VEZA_URL}}/api/preview/awf/workflows' \
-H 'authorization: Bearer '$token{
"values": [
{
"workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
"name": "demo",
"description": "demo",
"owner": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"notes": "",
"query": {
"raw_permissions": null,
"effective_permissions": null,
"source_node_types": {
"nodes": [
{
"node_type": "GoogleWorkspaceUser",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"required_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"avoided_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"destination_node_types": {
"nodes": [
{
"node_type": "GoogleCloudProject",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"no_relation": false,
"snapshot_id": "1690354800",
"waypoint_node_types": {
"nodes": [
{
"node_type": "GoogleCloudIamRoleBinding",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"path_summary_node_types": null,
"node_relationship_type": "CONFIGURED",
"include_all_source_tags_in_results": true,
"include_all_destination_tags_in_results": false,
"page_size": "0",
"page_token": ""
},
"creator": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"created_at": "2023-07-27T03:34:56.166550127Z"
},
{
"workflow_id": "baecbd47-bd3d-4d52-acb8-34840a8973b2",
"name": "Azure PS",
"description": "",
"owner": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"notes": "",
"query": {
"raw_permissions": null,
"effective_permissions": null,
"source_node_types": {
"nodes": [
{
"node_type": "Principal",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"required_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"avoided_intermediate_node_types": {
"nodes": [],
"nodes_operator": "AND"
},
"destination_node_types": {
"nodes": [
{
"node_type": "AzureDataLakeFilesystem",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"no_relation": false,
"snapshot_id": "1675900800",
"waypoint_node_types": null,
"path_summary_node_types": {
"nodes": [
{
"node_type": "AzureADGroup",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
},
{
"node_type": "ActiveDirectoryGroup",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
},
{
"node_type": "AzureRoleAssignment",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
},
{
"node_type": "AzureAssignmentPermissions",
"tags": [],
"conditions": [],
"condition_expression": null,
"node_id": "",
"excluded_tags": [],
"count_conditions": [],
"direct_relationship_only": false,
"node_type_grouping_constraint": null
}
],
"nodes_operator": "AND"
},
"node_relationship_type": "CONFIGURED",
"include_all_source_tags_in_results": false,
"include_all_destination_tags_in_results": false,
"page_size": "0",
"page_token": ""
},
"creator": {
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "earlypreview-auth0"
},
"created_at": "2023-02-09T03:07:24.458473708Z"
}
]
}curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/rows_group_by_setting' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/rows_group_by_setting?workflow_id=01983256-911c-7906-9d75-d69871c877fd' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN'{
"value": {
"group_by_column": "status",
"expand_groups_by_default": true
}
}curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/rows_group_by_setting' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-d '{
"value": {
"group_by_column": "destination.veza_unique_name",
"expand_groups_by_default": false
}
}'curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/rows_group_by_setting' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-d '{
"workflow_id": "01983256-911c-7906-9d75-d69871c877fd",
"value": {
"group_by_column": "destination.veza_unique_name",
"expand_groups_by_default": false
}
}'{} // Empty on success{
"workflow_id": "string",
"setting": {
"behavior": 0,
"note_to_add": "string"
}
}{
"workflow_id": "string",
"setting": {
"behavior": 1,
"note_to_add": "Rejected incomplete result due to review expiration."
}
}{
"value": {
"order_by": "destination.name desc"
}
}application/jsonOK
GET /api/private/workflows/access/global_settings/view_sort_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": {
"order_by": "source.type asc"
}
}application/jsonapplication/json{"value":{"order_by":"<string>"}}OK
PUT /api/private/workflows/access/global_settings/view_sort_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 33
{
"value": {
"order_by": "<string>"
}
}OK
{
"value": {
"order_by": "source.type asc"
}
}Update status info for custom webhooks
Configure default columns and visibility for reviewers.
Prevent auto assignment for specific users
<string>application/jsonOK
GET /api/private/workflows/access/global_settings/review_expiration_behavior HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": "AUTO_REJECT_INCOMPLETE_RESULTS",
"setting": {
"behavior": 0,
"note_to_add": "Rejected incomplete result due to review expiration."
}
}application/jsonapplication/jsonOptional workflow ID for configuration-specific settings
Expiration behavior: 0 = DO_NOTHING, 1 = AUTO_REJECT_INCOMPLETE_RESULTS
Note to add when auto-rejecting incomplete results
OK
PUT /api/private/workflows/access/global_settings/review_expiration_behavior HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 118
{
"workflow_id": "string",
"setting": {
"behavior": 1,
"note_to_add": "Rejected incomplete result due to review expiration."
}
}OK
{
"value": "AUTO_REJECT_INCOMPLETE_RESULTS",
"setting": {
"behavior": 1,
"note_to_add": "Rejected incomplete result due to review expiration."
}
}{
"result_id": "0",
"notification_status": "FAILED",
"webhook_info": "Ticket could not be created"
}{
"users": [
{
"user_type": "OktaUser",
"id": "123456",
"email": "mhines@cookie.ai",
"name": "Marilyn Hines"
}
]
}{
"users": [
{
"user_type": "OktaUser",
"id": "123456",
"email": "mhines@cookie.ai",
"name": "Marilyn Hines"
}
]
}{
"users": [
{
"user_type": "OktaUser",
"id": "123456",
"email": "mhines@cookie.ai",
"name": "Marilyn Hines"
}
]
}{
"value": {
"default_ordered_columns": [
"source.name",
"source.department",
"source.customprop_worker_status",
"source.tags",
"path_summary.name",
"concrete_permissions",
"destination.name",
"destination.customprop_display_name",
"reviewers"
],
"hide_from_reviewers_columns": [
"source.identity_unique_id",
"idp.on_premises_distinguished_name"
]
},
"workflow_id": "002063d2-7898-4183-b5fb-1192758fdec7"
}Get results for workflow certifications
Detailed graph relationships for certification results
Get all reviewers and details by certification
Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.
Methods for interacting with workflows and certifications
application/jsonOK
GET /api/private/workflows/access/global_settings/ui_column_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": {
"default_ordered_columns": [
"source.name",
"source.identity_unique_id",
"concrete_permissions",
"idp.on_premises_distinguished_name",
"idp.name",
"destination.name",
"destination.type",
"reviewers",
"notes",
"decision_by",
"decision_at",
"notification_status",
"automation_run_ids"
]
}
}application/jsonapplication/json{"value":{"default_ordered_columns":["source.name","source.identity_unique_id","concrete_permissions","idp.on_premises_distinguished_name","idp.name","destination.name","destination.type","reviewers","notes","decision_by","decision_at","notification_status","automation_run_ids"]}}OK
PUT /api/private/workflows/access/global_settings/ui_column_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 281
{
"value": {
"default_ordered_columns": [
"source.name",
"source.identity_unique_id",
"concrete_permissions",
"idp.on_premises_distinguished_name",
"idp.name",
"destination.name",
"destination.type",
"reviewers",
"notes",
"decision_by",
"decision_at",
"notification_status",
"automation_run_ids"
]
}
}OK
{
"value": {
"default_ordered_columns": [
"source.name",
"source.identity_unique_id",
"concrete_permissions",
"idp.on_premises_distinguished_name",
"idp.name",
"destination.name",
"destination.type",
"reviewers",
"notes",
"decision_by",
"decision_at",
"notification_status",
"automation_run_ids"
]
}
}application/jsonOK
Internal Server Error
application/jsonGET /api/private/workflows/access/global_settings/ui_column_settings:list_all HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"global_settings": {
"default_ordered_columns": [
"source.name",
"source.identity_unique_id",
"concrete_permissions",
"idp.on_premises_distinguished_name",
"idp.name",
"destination.name",
"destination.type",
"reviewers",
"notes",
"decision_by",
"decision_at",
"notification_status",
"automation_run_ids"
]
},
"workflow_settings": [
{
"workflow_id": "002063d2-7898-4183-b5fb-1192758fdec7",
"settings": {
"default_ordered_columns": [
"source.name",
"source.department",
"source.customprop_worker_status",
"source.tags",
"path_summary.name",
"concrete_permissions",
"destination.name",
"destination.type",
"destination.customprop_display_name",
"reviewers",
"notes"
]
}
},
{
"workflow_id": "84459ad9-3976-4f21-9d56-fa9c0694a8a7",
"settings": {
"default_ordered_columns": [
"source.aws_userid",
"source.name",
"source.identity_unique_id",
"concrete_permissions",
"destination.name",
"destination.type",
"reviewers",
"notes",
"decision_by",
"decision_at",
"notification_status",
"automation_run_ids"
]
}
}
]
}curl 'https://{{VezaURL}}/api/preview/awf/certifications/abe5c346-84ad-49b0-bafc-614a8365c883/reviewer_infos' \
-H 'authorization: Bearer '$TOKEN{
"values": [
{
"reviewer": {
"user_type": "localCookieUser",
"id": "dcadfc95-29f5-4130-b715-5476d40a5811",
"email": "reviewer@veza.com",
"name": "Access Reviewer"
},
"row_stats": {
"total": "1",
"no_decision": "0",
"accepted": "1",
"rejected": "0",
"fixed": "0",
"signed_off": "1"
}
}
]
}export VEZA_TOKEN=APIKEY
export VEZA_URL=https://your-org.vezacloud.comcurl "$VEZA_URL/api/preview/awf/workflows" \
-H "authorization: Bearer $VEZA_TOKEN"curl "$VEZA_URL/api/preview/awf/certifications?workflow_id=b9dc2586-5f30-4462-b6be-53f62debc40f" \
-H "authorization: Bearer $VEZA_TOKEN"curl "$VEZA_URL/api/preview/awf/certifications/b2562ef3-a4b3-4b30-8a45-1ba36f945d10/results?offset=0&size=30" \
-H "authorization: Bearer $VEZA_TOKEN"curl -X PUT "$VEZA_URL/api/preview/awf/certifications/b2562ef3-a4b3-4b30-8a45-1ba36f945d10/results" \
-H "authorization: Bearer $VEZA_TOKEN" \
-d '{"value": {"result_id": 0,"decisions": "REJECTED", "notes": "Over-privileged"}}'
curl '{{VEZA_URL}}/api/preview/awf/certifications/f9123002-f056-491f-978f-f203bc9885ed/results?page_token=0&page_size=1' \
-H 'authorization: Bearer '$token{
"values": [
{
"result_id": 0,
"source": {
"aliases": [],
"created_at": "2023-05-03T14:25:43Z",
"datasource_id": "datasource:google_cloud_workspace",
"email_addresses": [
"jdoe@cookiebeta.ai",
"jdoe@cookiebeta.ai.test-google-a.com",
"jdoe@veza.com"
],
"full_admin": false,
"google_cloud_organization_name": "organizations/123456789012",
"guest": false,
"id": "datasource:112655590859538682841",
"idp_unique_id": "jdoe@cookiebeta.ai",
"is_active": true,
"last_login_at": "2023-05-10T15:25:04Z",
"location_areas": [],
"mfa_enabled": false,
"name": "jdoe@cookiebeta.ai",
"organization_names": [],
"provider_id": "datasource",
"suspended": false,
"type": "GoogleWorkspaceUser",
"tags": [
{
"key": "department",
"type": "VEZA",
"value": "engineering"
}
]
},
"destination": {
"created_at": "2021-11-01T14:23:35Z",
"datasource_id": "datasource:google_cloud_iam",
"google_cloud_organization_name": "organizations/123456789012",
"id": "projects/743979515322",
"name": "Dev GCP Project",
"parent_id": "organizations/123456789012",
"project_id": "striped-graph-330814",
"provider_id": "datasource",
"type": "GoogleCloudProject",
"updated_at": "2022-04-07T22:08:48Z"
},
"accumulated_effective_permissions": [],
"accumulated_raw_permissions": [
"bigquery.datasets.get",
"bigquery.datasets.getIamPolicy",
"bigquery.tables.get",
"bigquery.tables.getIamPolicy",
"bigquery.tables.list",
"iam.roles.get",
"iam.roles.list",
"iam.serviceAccounts.create",
"iam.serviceAccounts.list",
"resourcemanager.folders.create",
"resourcemanager.folders.delete",
"resourcemanager.folders.get",
"resourcemanager.folders.getIamPolicy",
"resourcemanager.folders.list",
"resourcemanager.folders.move",
"resourcemanager.folders.setIamPolicy",
"resourcemanager.folders.undelete",
"resourcemanager.organizations.get",
"resourcemanager.organizations.getIamPolicy",
"resourcemanager.organizations.setIamPolicy",
"resourcemanager.projects.create",
"resourcemanager.projects.delete",
"resourcemanager.projects.get",
"resourcemanager.projects.getIamPolicy",
"resourcemanager.projects.list",
"resourcemanager.projects.move",
"resourcemanager.projects.setIamPolicy",
"resourcemanager.projects.update",
"storage.buckets.create",
"storage.buckets.createTagBinding",
"storage.buckets.delete",
"storage.buckets.deleteTagBinding",
"storage.buckets.get",
"storage.buckets.getIamPolicy",
"storage.buckets.list",
"storage.buckets.listTagBindings",
"storage.buckets.setIamPolicy",
"storage.buckets.update"
],
"updated_at": null,
"updated_by": null,
"signed_off_at": null,
"signed_off_by": null,
"notification_response_infos": [],
"notification_status": "UNKNOWN",
"waypoint": {
"id": "organizations/123456789012_policy_role_binding0",
"name": "CookieAIDevServicePrincipalRole",
"type": "GoogleCloudIamRoleBinding"
},
"action_log_entries": [],
"decision": "NONE",
"notes": "",
"reviewers": [
{
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "External User"
}
],
"signed_off_state": "NOT_SIGNED_OFF",
"reviewer_assignment": null,
"joined_nodes": {
"idp": {
"canonical_name": "Jane Doe",
"department": "Engineering",
"email": "jdoe@cookiebeta.ai",
"identity_type": "HUMAN",
"is_active": true,
"manager_email": "manager@cookiebeta.ai",
"name": "jdoe",
"type": "OAA.custom_idp.IDPUser"
}
}
},
{
"result_id": 1,
"source": {
"aliases": [],
"created_at": "2023-05-03T14:25:43Z",
"datasource_id": "datasource:google_cloud_workspace",
"email_addresses": [
"jdoe@cookiebeta.ai",
"jdoe@cookiebeta.ai.test-google-a.com",
"jdoe@veza.com"
],
"full_admin": false,
"google_cloud_organization_name": "organizations/123456789012",
"guest": false,
"id": "datasource:112655590859538682841",
"idp_unique_id": "jdoe@cookiebeta.ai",
"is_active": true,
"last_login_at": "2023-05-10T15:25:04Z",
"location_areas": [],
"mfa_enabled": false,
"name": "jdoe@cookiebeta.ai",
"organization_names": [],
"provider_id": "datasource",
"suspended": false,
"type": "GoogleWorkspaceUser"
},
"destination": {
"created_at": "2021-11-01T14:23:35Z",
"datasource_id": "datasource:google_cloud_iam",
"google_cloud_organization_name": "organizations/123456789012",
"id": "projects/743979515322",
"name": "Dev GCP Project",
"parent_id": "organizations/123456789012",
"project_id": "striped-graph-330814",
"provider_id": "datasource",
"type": "GoogleCloudProject",
"updated_at": "2022-04-07T22:08:48Z"
},
"accumulated_effective_permissions": [],
"accumulated_raw_permissions": [
"cloudkms.cryptoKeyVersions.create",
"cloudkms.cryptoKeyVersions.destroy",
"cloudkms.cryptoKeyVersions.get",
"cloudkms.cryptoKeyVersions.list",
"cloudkms.cryptoKeyVersions.restore",
"cloudkms.cryptoKeyVersions.update",
"cloudkms.cryptoKeyVersions.useToDecryptViaDelegation",
"cloudkms.cryptoKeyVersions.useToEncryptViaDelegation",
"cloudkms.cryptoKeys.create",
"cloudkms.cryptoKeys.get",
"cloudkms.cryptoKeys.getIamPolicy",
"cloudkms.cryptoKeys.list",
"cloudkms.cryptoKeys.setIamPolicy",
"cloudkms.cryptoKeys.update",
"cloudkms.keyRings.create",
"cloudkms.keyRings.createTagBinding",
"cloudkms.keyRings.deleteTagBinding",
"cloudkms.keyRings.get",
"cloudkms.keyRings.getIamPolicy",
"cloudkms.keyRings.list",
"cloudkms.keyRings.listTagBindings",
"cloudkms.keyRings.setIamPolicy",
"cloudkms.locations.get",
"cloudkms.locations.list",
"resourcemanager.projects.get"
],
"updated_at": null,
"updated_by": null,
"signed_off_at": null,
"signed_off_by": null,
"notification_response_infos": [],
"notification_status": "UNKNOWN",
"waypoint": {
"id": "organizations/123456789012_policy_role_binding11",
"name": "cloudkms.admin",
"type": "GoogleCloudIamRoleBinding"
},
"action_log_entries": [],
"decision": "NONE",
"notes": "",
"reviewers": [
{
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "External User"
}
],
"signed_off_state": "NOT_SIGNED_OFF",
"reviewer_assignment": null
}
],
"next_page_token": "EAI=",
"has_more": true,
"has_previous": false
}curl 'https://{{VezaURL}}/api/preview/awf/access_graph' \
-H 'authorization: Bearer '$TOKEN \
-G -d 'certification_id=abe5c346-84ad-49b0-bafc-614a8365c883' \
-d 'result_id=1'{
"nodes": [
{
"properties": {
"id": "arn:aws:iam::973979857296:role/FederatedS3",
"name": "FederatedS3",
"type": "AwsIamRole"
},
"out_edges": [
{
"destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509"
}
]
},
{
"properties": {
"id": "0bba9374-d4f5-4c77-93d2-7dfde581fa8a",
"name": "Abel_Maclead",
"type": "AzureADUser"
},
"out_edges": [
{
"destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3"
}
]
},
{
"properties": {
"id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509",
"name": "Read",
"type": "AwsIamEffectivePermission"
},
"out_edges": [
{
"destination_node_id": "arn:aws:s3:::cct-cct02-finance"
}
]
},
{
"properties": {
"id": "arn:aws:s3:::cct-cct02-finance",
"name": "cct-cct02-finance",
"type": "S3Bucket"
},
"out_edges": []
}
],
"accumulated_effective_permissions": [
"Read"
],
"accumulated_raw_permissions": [
"s3:GetObject"
],
"datasource_infos": [
{
"datasource_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef",
"external_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef",
"name": "",
"last_sync_time": "2022-09-12T22:15:34.874682421Z",
"agent_type": "",
"has_error": false,
"is_deleted": false,
"reason": "",
"last_error_message": "",
"has_warning": false
},
{
"datasource_id": "",
"external_id": "",
"name": "",
"last_sync_time": "2022-09-12T22:09:47.245436023Z",
"agent_type": "",
"has_error": false,
"is_deleted": false,
"reason": "",
"last_error_message": "",
"has_warning": false
}
]
}SELF_REVIEWER_CHECKING_ENABLED = 2 (or "SELF_REVIEWER_CHECKING_ENABLED" as string){
"value": "SELF_REVIEWER_CHECKING_DISABLED"
}{
"value": 1
}{
"value": "SELF_REVIEWER_CHECKING_ENABLED",
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/self_reviewer_settings?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/self_reviewer_settings' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"value": 1
}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/self_reviewer_settings' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"value": 2,
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'curl -X POST "https://{{veza_url}}/api/preview/awf/smart_action_definitions" \
-H 'authorization: Bearer {{access_token}}' \
-d '{
"apply_to_all_rows": "false",
"description": "Reject users where the user `is active` value is not `true`",
"filter": "source.is_active ne \"true\"",
"mutable_fields": {
"decision": "RESULT_DECISION_REJECTED"
},
"mutable_filter": "",
"name": "Reject inactive users",
"workflow_id": ""
}'{
"apply_to_all_rows": "false",
"description": "Sign off on all rejected rows",
"filter": "",
"mutable_fields": {
"signed_off_state": "SIGNED_OFF"
},
"mutable_filter": "decision eq \"RESULT_DECISION_REJECTED\"",
"name": "Sign off rejected rows",
"workflow_id": ""
}application/jsonOK
GET /api/private/workflows/access/global_settings/datasource_acknowledgement HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": "DATASOURCE_ACKNOWLEDGEMENT_REQUIRED"
}application/jsonapplication/json{"value":"<integer>"}OK
PUT /api/private/workflows/access/global_settings/datasource_acknowledgement HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 21
{
"value": "<integer>"
}OK
{
"value": "DATASOURCE_ACKNOWLEDGEMENT_REQUIRED"
}{
"value": "COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION"
}application/jsonOK
GET /api/private/workflows/access/global_settings/cert_completion_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": "COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION"
}application/jsonapplication/json{"value":"<integer>"}OK
PUT /api/private/workflows/access/global_settings/cert_completion_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 21
{
"value": "<integer>"
}OK
{
"value": "COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION"
}Customizing saved filters for certification reviewers.
Configure the fallback reviewer selection methods used when a valid reviewer cannot be assigned.
Control whether assigned reviewers can reassign rows to other reviewers.
Optional. If provided, returns the setting for this specific review configuration. If not provided or no configuration-specific setting exists, returns the global setting.
8ae1c414-3a76-46cb-950a-925316b3f264application/jsonOK
GET /api/private/workflows/access/global_settings/self_reviewer_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
OK
{
"value": "SELF_REVIEWER_CHECKING_DISABLED"
}application/jsonapplication/json1 = SELF_REVIEWER_CHECKING_DISABLED, 2 = SELF_REVIEWER_CHECKING_ENABLED
String values for self-review prevention settings
Optional. If provided, sets the setting for this specific review configuration only. If omitted, sets the global setting.
OK
PUT /api/private/workflows/access/global_settings/self_reviewer_settings HTTP/1.1
Host: {{baseurl}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 64
{
"value": 2,
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}OK
{
"value": "SELF_REVIEWER_CHECKING_DISABLED"
}Veza API key for authentication. Generate keys in Administration > API Keys.
empty workflow_id would mean that the smartAction can be used for any workflowId
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
POST /api/preview/awf/smart_action_definitions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2654
{
"name": "text",
"description": "text",
"workflow_id": "text",
"filter": "text",
"mutable_fields": {
"decision": 1,
"notes": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"updated_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"notification_infos": {
"values": [
{
"notification_type": 1,
"webhook_type": 1,
"status": 1,
"error_message": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"snow_info": {
"ticket_number": "text",
"sys_id": "text"
},
"webhook_info": {
"info": "text"
},
"jira_info": {
"keys": [
"text"
]
},
"slack_app_info": {}
}
]
},
"notification_status": 1,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"signed_off_state": 1,
"signed_off_at": "2026-01-01T00:00:00.000Z",
"signed_off_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"action_log": {
"entries": [
{
"action": 1,
"user": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"time": "2026-01-01T00:00:00.000Z",
"note": "text",
"reviewer_detail": {
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"new_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
]
},
"decision_detail": {
"decision": 1,
"note": "text"
},
"decision_cleared_detail": {
"previous_decision": 1,
"original_decider": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"reason": 1
},
"revocation_request_detail": {
"request_id": "text"
},
"approval_level": 1
}
]
},
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"automation_run_ids": [
"text"
],
"decision_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"decision_at": "2026-01-01T00:00:00.000Z",
"revoke_request_infos": [
{
"id": "text",
"state": 1,
"error_message": "text"
}
],
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"predefined_question_response": [
{
"question_id": "text",
"answer_id": "text",
"answer_text": "text"
}
],
"is_assigned_to_current_user": true,
"ai_suggestion": {
"suggestion": 1,
"reason_codes": [
"text"
],
"cohort_id": "text",
"cohort_index": 1
},
"itsm_request_number": "text",
"itsm_request_status": "text",
"itsm_request_url": "text",
"itsm_request_last_updated_at": "2026-01-01T00:00:00.000Z"
},
"mutable_filter": "text",
"apply_to_all_rows": true
}{
"id": "text"
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
DELETE /api/preview/awf/smart_action_definitions/{id} HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}Veza API key for authentication. Generate keys in Administration > API Keys.
If no value is passed for workflow_id, all smart actions will be returned. If workflow_id is not "", smart actions with a matching workflow_id or with an empty workflow_id will be returned.
OK
empty workflow_id would mean that the smartAction can be used for any workflowId
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/preview/awf/smart_action_definitions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"values": [
{
"id": "text",
"description": "text",
"name": "text",
"workflow_id": "text",
"filter": "text",
"mutable_fields": {
"decision": 1,
"notes": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"updated_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"notification_infos": {
"values": [
{
"notification_type": 1,
"webhook_type": 1,
"status": 1,
"error_message": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"snow_info": {
"ticket_number": "text",
"sys_id": "text"
},
"webhook_info": {
"info": "text"
},
"jira_info": {
"keys": [
"text"
]
},
"slack_app_info": {}
}
]
},
"notification_status": 1,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"signed_off_state": 1,
"signed_off_at": "2026-01-01T00:00:00.000Z",
"signed_off_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"action_log": {
"entries": [
{
"action": 1,
"user": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"time": "2026-01-01T00:00:00.000Z",
"note": "text",
"reviewer_detail": {
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"new_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
]
},
"decision_detail": {
"decision": 1,
"note": "text"
},
"decision_cleared_detail": {
"previous_decision": 1,
"original_decider": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"reason": 1
},
"revocation_request_detail": {
"request_id": "text"
},
"approval_level": 1
}
]
},
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"automation_run_ids": [
"text"
],
"decision_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"decision_at": "2026-01-01T00:00:00.000Z",
"revoke_request_infos": [
{
"id": "text",
"state": 1,
"error_message": "text"
}
],
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"predefined_question_response": [
{
"question_id": "text",
"answer_id": "text",
"answer_text": "text",
"respondent_user": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"responded_at": "2026-01-01T00:00:00.000Z"
}
],
"is_assigned_to_current_user": true,
"ai_suggestion": {
"suggestion": 1,
"reason_codes": [
"text"
],
"cohort_id": "text",
"cohort_index": 1
},
"itsm_request_number": "text",
"itsm_request_status": "text",
"itsm_request_url": "text",
"itsm_request_last_updated_at": "2026-01-01T00:00:00.000Z"
},
"mutable_filter": "text",
"apply_to_all_rows": true
}
]
}Veza API key for authentication. Generate keys in Administration > API Keys.
empty workflow_id would mean that the smartAction can be used for any workflowId
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
PUT /api/preview/awf/smart_action_definitions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2676
{
"value": {
"id": "text",
"description": "text",
"name": "text",
"workflow_id": "text",
"filter": "text",
"mutable_fields": {
"decision": 1,
"notes": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"updated_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"notification_infos": {
"values": [
{
"notification_type": 1,
"webhook_type": 1,
"status": 1,
"error_message": "text",
"updated_at": "2026-01-01T00:00:00.000Z",
"snow_info": {
"ticket_number": "text",
"sys_id": "text"
},
"webhook_info": {
"info": "text"
},
"jira_info": {
"keys": [
"text"
]
},
"slack_app_info": {}
}
]
},
"notification_status": 1,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"signed_off_state": 1,
"signed_off_at": "2026-01-01T00:00:00.000Z",
"signed_off_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"action_log": {
"entries": [
{
"action": 1,
"user": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"time": "2026-01-01T00:00:00.000Z",
"note": "text",
"reviewer_detail": {
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"new_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
]
},
"decision_detail": {
"decision": 1,
"note": "text"
},
"decision_cleared_detail": {
"previous_decision": 1,
"original_decider": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"reason": 1
},
"revocation_request_detail": {
"request_id": "text"
},
"approval_level": 1
}
]
},
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"automation_run_ids": [
"text"
],
"decision_by": {
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
},
"decision_at": "2026-01-01T00:00:00.000Z",
"revoke_request_infos": [
{
"id": "text",
"state": 1,
"error_message": "text"
}
],
"old_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"predefined_question_response": [
{
"question_id": "text",
"answer_id": "text",
"answer_text": "text"
}
],
"is_assigned_to_current_user": true,
"ai_suggestion": {
"suggestion": 1,
"reason_codes": [
"text"
],
"cohort_id": "text",
"cohort_index": 1
},
"itsm_request_number": "text",
"itsm_request_status": "text",
"itsm_request_url": "text",
"itsm_request_last_updated_at": "2026-01-01T00:00:00.000Z"
},
"mutable_filter": "text",
"apply_to_all_rows": true
}
}{}curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/cert_completion_settings' \
-H 'authorization: Bearer mZ1eqKMACtP...' \
-d '{"value": "AUTO_COMPLETE_DISABLED"}'POST {Veza URL}/api/preview/awf/quick_filters
{
"name": "custom filter",
"filter": "source.type co \"admin\"",
"workflow_id": "ad78350a-bfe5-4eff-a160-dccbe28c6961"
}{
"id": "41761624-cb9c-4668-be69-3b0f359a45e3"
}GET {Veza URL}/api/preview/awf/quick_filtersGET {Veza URL}/api/preview/awf/quick_filters?workflow_id=78be0b3d-d6f4-4e5d-98c4-7b1db1a88575{
"values": [
{
"id": "4a1dbf1a-282f-4faf-81f2-6ee3752b5cb2",
"name": "User type = admin",
"workflow_id": "78be0b3d-d6f4-4e5d-98c4-7b1db1a88575",
"filter": "source.type eq \"admin\""
},
{
"id": "69b131b0-8af5-4ab1-9099-91c03ca54555",
"name": "abstract permissions include delete",
"workflow_id": "",
"filter": "abstract_permissions co \"Delete\""
},
{
"id": "88e5d197-6555-4e3f-a48d-43713b340a2c",
"name": "destination org filter",
"workflow_id": "",
"filter": "destination.google_cloud_organization_name eq \"acme\""
},
{
"id": "df944da1-76fe-42e0-829e-b8bf0a200f39",
"name": "concrete permissions include abort multipart upload",
"workflow_id": "78be0b3d-d6f4-4e5d-98c4-7b1db1a88575",
"filter": "concrete_permissions co \"s3:AbortMultipartUpload\""
},
{
"id": "f722936d-a8f7-4b38-acb2-a41e12ec2673",
"name": "User type is AwsIamUser",
"workflow_id": "78be0b3d-d6f4-4e5d-98c4-7b1db1a88575",
"filter": "source.type co \"AwsIamUser\""
}
]
}DELETE {Veza URL}/api/preview/awf/quick_filters/d31cfa3f-1999-4789-8ec1-a844c03dd622{
"value": "NOT_ALLOWED"
}{
"value": "NOT_ALLOWED",
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewers_to_reassign_rows' \
-H 'Authorization: Bearer YOUR_API_KEY'curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewers_to_reassign_rows?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'{
"value": "ALLOWED"
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewers_to_reassign_rows' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": "NOT_ALLOWED"
}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewers_to_reassign_rows' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": "NOT_ALLOWED",
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'{}{
"value": {
"selection_methods": ["REVIEWERS_MANAGER", "CERTIFICATION_ALTERNATE_REVIEWERS", "WORKFLOW_CREATOR", "ADMIN"]
}
}{
"value": {
"selection_methods": [1, 2]
}
}curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/alternate_reviewer_settings' \
-H 'Authorization: Bearer YOUR_API_KEY'{
"value": {
"selection_methods": [
"REVIEWERS_MANAGER",
"CERTIFICATION_ALTERNATE_REVIEWERS",
"WORKFLOW_CREATOR",
"ADMIN"
]
}
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/alternate_reviewer_settings' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"selection_methods": [1, 2, 3, 4]
}
}'Update a single result with escalated privileges
Configure outlier detection settings to identify anomalous access patterns in Access Reviews.
Return a single certification result
Add decisions and notes to a certification result
Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/private/workflows/access/global_settings/alternate_reviewer_settings HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"value": {
"selection_methods": [
1
]
}
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
PUT /api/private/workflows/access/global_settings/alternate_reviewer_settings HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 35
{
"value": {
"selection_methods": [
1
]
}
}{}curl -X PUT "$VEZA_URL/api/preview/awf/workflows/58e6ff05-0918-4060-9edd-5e1017f26bac" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Quarterly Snowflake Role Review",
"description": "Certify access from top-level principals to Snowflake roles via Okta app membership.",
"query": {
"source_node_types": {
"nodes": [
{
"node_type": "PrincipalTopLevel",
"tags": [],
"conditions": [],
"direct_relationship_only": false
}
]
},
"destination_node_types": {
"nodes": [
{
"node_type": "SnowflakeRole",
"tags": [],
"conditions": [],
"direct_relationship_only": false
}
]
},
"path_summary_node_types": {
"nodes": [
{
"node_type": "OktaAppUser"
}
]
},
"node_relationship_type": "EFFECTIVE_ACCESS",
"include_dynamic_node_types": true
},
"webhooks": {
"action_webhooks": [
{
"action_name": "SIGN_OFF_REJECTED",
"webhook_id": "a1b2c3d4-0000-0000-0000-000000000000",
"type": "WEBHOOK"
}
]
},
"revoke_access_on_rejected_rows": "DO_REVOKE"
}'{}curl '{{VEZA_URL}}/api/preview/awf/certifications/f9123002-978f-f203bc9885ed/results:force_update' \
-H 'authorization: Bearer '$token \
-D '{"value": {"result_id": 0,"signed_off_state":"NOT_SIGNED_OFF"}}'{}curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/manager_centric_config' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-H 'Content-Type: application/json'curl 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/manager_centric_config?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-H 'Content-Type: application/json'{
"value": {
"grouping_properties": [
{
"property_name": "manager_idp_unique_id"
}
],
"threshold": 0.15
}
}curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/manager_centric_config' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"value": {
"grouping_properties": [
{
"property_name": "department",
"target": "TARGET_NODE_SOURCE"
},
{
"property_name": "location",
"target": "TARGET_NODE_SOURCE"
}
],
"threshold": 0.1
}
}'curl -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/manager_centric_config' \
-H 'Authorization: Bearer YOUR_BEARER_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264",
"value": {
"grouping_properties": [
{
"property_name": "manager_idp_unique_id"
}
],
"threshold": 0.2
}
}'{}{
"property_name": "department",
"target": "TARGET_NODE_SOURCE"
}{
"property_name": "classification",
"target": "TARGET_NODE_DESTINATION"
}{
"property_name": "department",
"target": "TARGET_NODE_JOINED",
"joined_node_alias": "manager"
}{
"value": {
"grouping_properties": [
{
"property_name": "manager_idp_unique_id"
}
],
"threshold": 0.15
}
}{
"value": {
"grouping_properties": [
{
"property_name": "department",
"target": "TARGET_NODE_SOURCE"
},
{
"property_name": "location",
"target": "TARGET_NODE_SOURCE"
}
],
"threshold": 0.1
}
}{
"value": {
"grouping_properties": [],
"threshold": 0.05
}
}{
"value": {
"grouping_properties": [
{
"property_name": "classification",
"target": "TARGET_NODE_DESTINATION"
}
],
"threshold": 0.2
}
}{
"value": {
"grouping_properties": [
{
"property_name": "department",
"target": "TARGET_NODE_JOINED",
"joined_node_alias": "manager"
}
],
"threshold": 0.15
}
}{
"value": {
"grouping_properties": [
{
"property_name": "department",
"target": "TARGET_NODE_SOURCE"
}
],
"threshold": 0.05
}
}{
"value": {
"grouping_properties": [
{
"property_name": "team",
"target": "TARGET_NODE_SOURCE"
},
{
"property_name": "environment",
"target": "TARGET_NODE_DESTINATION"
}
],
"threshold": 0.1
}
}{
"value": {
"grouping_properties": [
{
"property_name": "job_role",
"target": "TARGET_NODE_SOURCE"
}
],
"threshold": 0.15
}
}{
"value": {
"grouping_properties": [
{
"property_name": "department",
"target": "TARGET_NODE_SOURCE"
},
{
"property_name": "location",
"target": "TARGET_NODE_SOURCE"
}
],
"threshold": 0.08
}
}curl '{{VEZA_URL}}/api/preview/awf/certifications/f9123002-978f-f203bc9885ed/results/0' \
-H 'authorization: Bearer '$token{
"value": {
"result_id": 0,
"source": {
"aliases": [],
"created_at": "2023-05-03T14:25:43Z",
"datasource_id": "datasource:google_cloud_workspace",
"email_addresses": [
"jdoe@cookiebeta.ai",
"jdoe@cookiebeta.ai.test-google-a.com",
"jdoe@veza.com"
],
"full_admin": false,
"google_cloud_organization_name": "organizations/123456789012",
"guest": false,
"id": "datasource:112655590859538682841",
"idp_unique_id": "jdoe@cookiebeta.ai",
"is_active": true,
"last_login_at": "2023-05-10T15:25:04Z",
"location_areas": [],
"mfa_enabled": false,
"name": "jdoe@cookiebeta.ai",
"organization_names": [],
"provider_id": "datasource",
"suspended": false,
"type": "GoogleWorkspaceUser",
"tags": [
{
"key": "department",
"type": "VEZA",
"value": "engineering"
}
]
},
"destination": {
"created_at": "2021-11-01T14:23:35Z",
"datasource_id": "datasource:google_cloud_iam",
"google_cloud_organization_name": "organizations/123456789012",
"id": "projects/743979515322",
"name": "Dev GCP Project",
"parent_id": "organizations/123456789012",
"project_id": "striped-graph-330814",
"provider_id": "datasource",
"type": "GoogleCloudProject",
"updated_at": "2022-04-07T22:08:48Z"
},
"accumulated_effective_permissions": [],
"accumulated_raw_permissions": [
"bigquery.datasets.get",
"bigquery.datasets.getIamPolicy",
"bigquery.tables.get",
"bigquery.tables.getIamPolicy",
"bigquery.tables.list",
"iam.roles.get",
"iam.roles.list",
"iam.serviceAccounts.create",
"iam.serviceAccounts.list",
"resourcemanager.folders.create",
"resourcemanager.folders.delete",
"resourcemanager.folders.get",
"resourcemanager.folders.getIamPolicy",
"resourcemanager.folders.list",
"resourcemanager.folders.move",
"resourcemanager.folders.setIamPolicy",
"resourcemanager.folders.undelete",
"resourcemanager.organizations.get",
"resourcemanager.organizations.getIamPolicy",
"resourcemanager.organizations.setIamPolicy",
"resourcemanager.projects.create",
"resourcemanager.projects.delete",
"resourcemanager.projects.get",
"resourcemanager.projects.getIamPolicy",
"resourcemanager.projects.list",
"resourcemanager.projects.move",
"resourcemanager.projects.setIamPolicy",
"resourcemanager.projects.update",
"storage.buckets.create",
"storage.buckets.createTagBinding",
"storage.buckets.delete",
"storage.buckets.deleteTagBinding",
"storage.buckets.get",
"storage.buckets.getIamPolicy",
"storage.buckets.list",
"storage.buckets.listTagBindings",
"storage.buckets.setIamPolicy",
"storage.buckets.update"
],
"updated_at": null,
"updated_by": null,
"signed_off_at": null,
"signed_off_by": null,
"notification_response_infos": [],
"notification_status": "UNKNOWN",
"waypoint": {
"id": "organizations/123456789012_policy_role_binding0",
"name": "CookieAIDevServicePrincipalRole",
"type": "GoogleCloudIamRoleBinding"
},
"action_log_entries": [],
"decision": "NONE",
"notes": "",
"reviewers": [
{
"user_type": "localCookieUser",
"id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
"email": "cookie@cookie.ai",
"name": "External User"
}
],
"signed_off_state": "NOT_SIGNED_OFF",
"reviewer_assignment": null,
"joined_nodes": {
"idp": {
"canonical_name": "Jane Doe",
"department": "Engineering",
"email": "jdoe@cookiebeta.ai",
"identity_type": "HUMAN",
"is_active": true,
"manager_email": "manager@cookiebeta.ai",
"name": "jdoe",
"type": "OAA.custom_idp.IDPUser"
}
}
}
}curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
--data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "CustomIDPUser", "id": "125", "email": "cookiedemo@cookie.ai", "name": "Valid Reviewer"}]}}'curl -X PUT '{{baseurl}}/api/preview/awf/certifications/f9123002-f056-491f-978f-f203bc9885ed/results' \
-H 'authorization: Bearer '$token \
--data-raw '{
"value": {
"result_id": 0,
"decision": "REJECTED",
"notes": "Over-privileged"
}
}'curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
--data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "CustomIDPUser", "id": "125", "email": "cookiedemo@cookie.ai", "name": "Valid Reviewer"}]}}'curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
--data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "localCookieUser", "id": "0ffcfbc7-6339-4aed-afa4-ff3bea505485", "email": "cookie@cookie.ai", "name": "demo-auth0"}]}}'Configure delegate Veza users who will be assigned as certification reviewers whenever a specified user would have been assigned.
Control which bulk actions are available to reviewers.
Get, create, update, delete, and attach Intelligent Automations.
Veza API key for authentication. Generate keys in Administration > API Keys.
Optional. If empty, returns the global tenant setting. If provided, returns the workflow-specific setting.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/private/workflows/access/global_settings/reviewer_bulk_actions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"value": {
"allow_bulk_approve": true,
"allow_bulk_reject": true,
"allow_bulk_signoff": true,
"allow_bulk_clear_decisions": true,
"allow_bulk_add_note": true,
"allow_bulk_reassign": true
}
}Veza API key for authentication. Generate keys in Administration > API Keys.
Optional. If empty, sets the global tenant setting. If provided, sets the workflow-specific setting.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
PUT /api/private/workflows/access/global_settings/reviewer_bulk_actions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 197
{
"value": {
"allow_bulk_approve": true,
"allow_bulk_reject": true,
"allow_bulk_signoff": true,
"allow_bulk_clear_decisions": true,
"allow_bulk_add_note": true,
"allow_bulk_reassign": true
},
"workflow_id": "text"
}{}curl -X POST 'https://{{VezaURL}}/api/preview/awf/delegation/users:add' \
-H 'authorization: Bearer '$TOKEN \
-d @configuration.json{
"values": [
{
"original_user": {
"user_type": "localCookieUser",
"id": "2cdfb6e9-6f20-4198-925c-a045a3d690a0",
"email": "original_reviewer@veza.com",
"name": "External User"
},
"delegate_user": {
"user_type": "localCookieUser",
"id": "b8678b1b-0f31-40e4-9842-47b272694354",
"email": "delegate_reviewer@veza.com",
"name": "External User"
}
}
]
}{
"values": [
{
"original_user": {
"user_type": "OktaUser",
"id": "00upa6s0hSGtl1eGL5d5",
"email": "Abel_Maclead@veza.com",
"name": "Abel_Maclead@veza.com"
},
"delegate_user": {
"user_type": "OktaUser",
"id": "00u6h8rl61RiosYzi5d7",
"email": "adam_lee@veza.com",
"name": "adam_lee@veza.com"
}
}
]
}curl 'https://{{VezaURL}}/api/preview/awf/delegation/users' \
-H 'authorization: Bearer '$TOKEN{
"values": [
{
"original_user": {
"user_type": "localCookieUser",
"id": "2cdfb6e9-6f20-4198-925c-a045a3d690a0",
"email": "original_reviewer@veza.com",
"name": "Resource Manager"
},
"delegate_user": {
"user_type": "localCookieUser",
"id": "52c38da6-3b2e-44e9-9787-88ffa5ef398c",
"email": "delegate_reviewer@veza.com",
"name": "Backup Manager"
}
}
]
}curl -X POST 'https://{{VezaURL}}/api/preview/awf/delegation/users:remove' \
-H 'authorization: Bearer '$TOKEN \
-d @configuration/to/remove.json{
"value": {
"allow_bulk_approve": false,
"allow_bulk_reject": false,
"allow_bulk_signoff": true,
"allow_bulk_clear_decisions": true,
"allow_bulk_add_note": true,
"allow_bulk_reassign": true
}
}{
"value": {
"allow_bulk_approve": false,
"allow_bulk_reject": false,
"allow_bulk_signoff": false,
"allow_bulk_clear_decisions": false,
"allow_bulk_add_note": false,
"allow_bulk_reassign": false
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/reviewer_bulk_actions' \
-H 'Authorization: Bearer YOUR_API_KEY'curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/reviewer_bulk_actions?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'{
"value": {
"allow_bulk_approve": true,
"allow_bulk_reject": true,
"allow_bulk_signoff": true,
"allow_bulk_clear_decisions": true,
"allow_bulk_add_note": true,
"allow_bulk_reassign": true
}
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/reviewer_bulk_actions' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"allow_bulk_approve": false,
"allow_bulk_reject": false,
"allow_bulk_signoff": true,
"allow_bulk_clear_decisions": true,
"allow_bulk_add_note": true,
"allow_bulk_reassign": true
}
}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/reviewer_bulk_actions' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
"value": {
"allow_bulk_approve": false,
"allow_bulk_reject": false,
"allow_bulk_signoff": false,
"allow_bulk_clear_decisions": false,
"allow_bulk_add_note": false,
"allow_bulk_reassign": false
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'{}{
"id": "e48dd2c8-3633-463b-a477-0177a942b5a6",
"name": "Highlight inactive sources",
"description": "Highlight rows where the source account is inactive",
"priority": 0,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "source.is_active eq false",
"mutable_filter": ""
},
"action": {
"display_style": "HIGHLIGHT",
"display_text": "Source account is inactive",
"highlight_color": "#FF6B35"
}
}{
"id": "f59ee3d9-4744-574c-b588-1288b0942c7c",
"name": "Reject privileged account access",
"description": "Suggest reject for admin or root accounts",
"priority": 0,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "(destination.name eq \"admin\") OR (source.name eq \"root\")",
"mutable_filter": ""
},
"action": {
"display_style": "SUGGEST_REJECT",
"display_text": "Privileged account detected - review carefully"
}
}{
"id": "string",
"name": "string",
"description": "string",
"priority": 0,
"attachment_behavior": {
"attach_to_new_workflows": boolean,
"opt_in": boolean
},
"criteria": {
"filter": "string",
"mutable_filter": "string"
},
"action": {
// For modification actions:
"decision": "string",
"signed_off_state": "string",
"notes": "string",
"reviewer_assignment": null,
// OR for display actions:
"display_style": "string",
"display_text": "string",
"highlight_color": "string"
}
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
The display text can be used to show a message to the user when the automation is applied. Currently supported for display_style type actions.
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/preview/awf/automations HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"values": [
{
"id": "text",
"name": "text",
"description": "text",
"priority": 1,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "text",
"mutable_filter": "text"
},
"action": {
"decision": 1,
"signed_off_state": 1,
"notes": "text",
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"display_style": 1,
"display_text": "text",
"highlight_color": "text"
}
}
]
}Veza API key for authentication. Generate keys in Administration > API Keys.
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
The display text can be used to show a message to the user when the automation is applied. Currently supported for display_style type actions.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
PUT /api/preview/awf/automations HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 678
{
"value": {
"id": "text",
"name": "text",
"description": "text",
"priority": 1,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "text",
"mutable_filter": "text"
},
"action": {
"decision": 1,
"signed_off_state": 1,
"notes": "text",
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"display_style": 1,
"display_text": "text",
"highlight_color": "text"
}
}
}{}Veza API key for authentication. Generate keys in Administration > API Keys.
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
The display text can be used to show a message to the user when the automation is applied. Currently supported for display_style type actions.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
POST /api/preview/awf/automations HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 656
{
"name": "text",
"description": "text",
"priority": 1,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "text",
"mutable_filter": "text"
},
"action": {
"decision": 1,
"signed_off_state": 1,
"notes": "text",
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"display_style": 1,
"display_text": "text",
"highlight_color": "text"
}
}{
"id": "text"
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
The display text can be used to show a message to the user when the automation is applied. Currently supported for display_style type actions.
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/preview/awf/automations/{id} HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"value": {
"id": "text",
"name": "text",
"description": "text",
"priority": 1,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "text",
"mutable_filter": "text"
},
"action": {
"decision": 1,
"signed_off_state": 1,
"notes": "text",
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"display_style": 1,
"display_text": "text",
"highlight_color": "text"
}
}
}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
DELETE /api/preview/awf/automations/{id} HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}Veza API key for authentication. Generate keys in Administration > API Keys.
Attaches an automation to one or all workflows Attach will succeeds if the automation is already attached and will update the "opt_in" if necessary
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
POST /api/preview/awf/automations:attach HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 59
{
"id": "text",
"workflow_id": "text",
"all": true,
"opt_in": true
}{}Veza API key for authentication. Generate keys in Administration > API Keys.
OK
This is a list of approval levels. For each approval level listed, we will attempt to assign managers of the reviewers assigned for that approval level. For example, if this assignment instruction is for the second approval level and the first approval level is specified here, we will assign the manager of the reviewer from the first approval level for the second approval level reviewer. Approval levels are "Zero Indexed" so the first approval level is 0, the second is 1, etc. This is only supported for review creation, it is not supported for updating reviewers of existing results.
Assign reviewer(s) from the comparable row (matched by principal.type/id + resource.type/id) in the prior review. New rows fall through; rows that existed but were unassigned stay unassigned. Creation-only.
The display text can be used to show a message to the user when the automation is applied. Currently supported for display_style type actions.
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
GET /api/preview/awf/automations:attached/{workflow_id} HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"values": [
{
"automation": {
"id": "text",
"name": "text",
"description": "text",
"priority": 1,
"attachment_behavior": {
"attach_to_new_workflows": true,
"opt_in": true
},
"criteria": {
"filter": "text",
"mutable_filter": "text"
},
"action": {
"decision": 1,
"signed_off_state": 1,
"notes": "text",
"reviewer_assignment": {
"users_manager": true,
"resource_managers": true,
"reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"fallback_reviewers": [
{
"user_type": "text",
"id": "text",
"email": "text",
"name": "text",
"alternate_email": "text"
}
],
"reviewers_managers_for_approval_levels": [
1
],
"previous_review_assignment": true
},
"display_style": 1,
"display_text": "text",
"highlight_color": "text"
}
},
"opt_in": true
}
]
}Veza API key for authentication. Generate keys in Administration > API Keys.
Detaches an automation from one or all workflows
OK
Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
The type of the serialized message.
POST /api/preview/awf/automations:detach HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"id": "text",
"workflow_id": "text",
"all": true
}{}{"type": "USER", "id": "<veza-user-uuid>"}
{"type": "GROUP", "id": "<veza-group-uuid>"}curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN'{"enabled": false}{
"enabled": true
}curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"enabled": true}'curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/settings/action_allowlist_enabled' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"enabled": false}'{
"principals": [
{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}
],
"allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
}curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"principals": [{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}],
"allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
}'curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"principals": [{"type": "GROUP", "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901"}],
"allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
}'{
"principals": [
{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}
],
"allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
}curl -L -X POST 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist:delete' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"principals": [{"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}],
"allowed_action": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]
}'curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN'{
"entries": [
{
"principal": {"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "name": "Jane Smith"},
"allowed_action": "DELETE_IN_PROGRESS_REVIEW"
},
{
"principal": {"type": "USER", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "name": "Jane Smith"},
"allowed_action": "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"
},
{
"principal": {"type": "GROUP", "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "name": "Review Admins"},
"allowed_action": "DELETE_IN_PROGRESS_REVIEW"
}
],
"next_page_token": "",
"has_more": false,
"total_count": 3
}curl -L -X GET 'https://your-organization.vezacloud.com/api/private/workflows/access/action_allowlist/a1b2c3d4-e5f6-7890-abcd-ef1234567890' \
-H 'Authorization: Bearer YOUR_SECRET_TOKEN'{"allowed_actions": ["DELETE_IN_PROGRESS_REVIEW", "MODIFY_IN_PROGRESS_REVIEW_DUE_DATE"]}{
"entries": [
{
"action": "REVIEWER_ASSIGNED",
"user": {
"user_type": "localCookieUser",
"id": "e5aeaaf6-5d7a-4982-aa61-d0e6dea612a5",
"email": "cookie@cookie.ai",
"name": "preview-auth0"
},
"time": "2022-09-20T17:50:06.939577367Z",
"reviewer_detail": {
"old_reviewers": [],
"new_reviewers": [
{
"user_type": "localCookieUser",
"id": "299d63c2-8edb-4ed1-a725-e56d84d956b7",
"email": "aallen@veza.com",
"name": "docs"
}
]
}
},
{
"action": "DECISION",
"user": {
"user_type": "localCookieUser",
"id": "e5aeaaf6-5d7a-4982-aa61-d0e6dea612a5",
"email": "cookie@cookie.ai",
"name": "preview-auth0"
},
"time": "2022-09-20T17:50:21.424281596Z",
"decision_detail": {
"decision": "RESULT_DECISION_ACCEPTED",
"note": "OK"
}
},
{
"action": "DECISION",
"user": {
"user_type": "localCookieUser",
"id": "e5aeaaf6-5d7a-4982-aa61-d0e6dea612a5",
"email": "cookie@cookie.ai",
"name": "preview-auth0"
},
"time": "2022-09-20T17:50:44.381372987Z",
"decision_detail": {
"decision": "RESULT_DECISION_FIXED",
"note": ""
}
},
{
"action": "NOTE_ADDED",
"user": {
"user_type": "localCookieUser",
"id": "e5aeaaf6-5d7a-4982-aa61-d0e6dea612a5",
"email": "cookie@cookie.ai",
"name": "preview-auth0"
},
"time": "2022-09-20T17:52:14.773114900Z",
"note": "updating the note"
}
]
}{
"reviewer_assignment": {
"fallback_reviewers": [
{
"email": "string",
"id": "string",
"name": "string",
"user_type": "string"
}
],
"resource_managers": true,
"reviewers": [
{
"email": "string",
"id": "string",
"name": "string",
"user_type": "string"
}
],
"users_manager": true
}
}Manage custom help pages for Veza Access Reviews.
# Help for {{WORKFLOW_NAME}}
## Formatting
Formatting text in Markdown:
- *Italic text*
- **Bold text**
- `Code block`
- [Link text](https://example.com)
## Bullet Lists
Bullet lists in Markdown:
- Item 1
- Item 2
- Item 3
## Numbered Lists
Numbered lists in Markdown:
1. First item
2. Second item
3. Third item
## Placeholders
The following placeholders are available:
- {{WORKFLOW_NAME}}
- {{WORKFLOW_URL}}
- {{WORKFLOW_TIME}}
- {{WORKFLOW_OWNER}}
- {{WORKFLOW_DESCRIPTION}}
- {{WORKFLOW_CERT_STARTED_ON_DATE}}
- {{WORKFLOW_CERT_STARTED_ON_TIME}}
- {{WORKFLOW_CERT_CREATED_BY}}
- {{WORKFLOW_CERT_LAST_UPDATED_ON_DATE}}
- {{WORKFLOW_CERT_LAST_UPDATED_ON_TIME}}
- {{WORKFLOW_CERT_LAST_UPDATED_BY}}
- {{WORKFLOW_CERT_COMPLETED_ON_DATE}}
- {{WORKFLOW_CERT_COMPLETED_ON_TIME}}
- {{WORKFLOW_CERT_COMPLETED_BY}}
- {{WORKFLOW_CERT_LAST_ACTIVITY_ON_DATE}}
- {{WORKFLOW_CERT_LAST_ACTIVITY_ON_TIME}}
- {{WORKFLOW_CERT_LAST_ACTIVITY_BY}}
- {{WORKFLOW_CERT_DUE_ON_DATE}}
- {{WORKFLOW_CERT_REVIEWERS}}POST {{veza_url}}/api/preview/awf/help_page_templates{
"value": {
"workflow_id": "bc2b2daa-3508-4c0c-a0f2-8a2fb0ef59d9",
"name": "Review Help",
"template_body": "# {{WORKFLOW_NAME}} Review Guide\n\nWelcome to the {{WORKFLOW_NAME}} review process. Please follow the steps below:\n\n## Review Steps\n\n",
"usage": "HELP_PAGE"
}
}placeholder {{WORKFLOW_CERT_LOGGED_IN_USER_EMAIL}} is only supported in REVIEW_START and SIGN_OFF templatesI, {{WORKFLOW_CERT_LOGGED_IN_USER_DISPLAY_NAME}} ({{WORKFLOW_CERT_LOGGED_IN_USER_EMAIL}}), confirm that I have reviewed the selected rows in {{WORKFLOW_NAME}} and that my access decisions are accurate.
Acknowledged on {{DATE_NOW}}.GET {{veza_url}}/api/preview/awf/help_page_templates{
"values": [
{
"workflow_id": "8c1772da-a7c3-4dc7-8b09-b900af011ee5",
"name": "Review Start Popup",
"usage": "REVIEW_START"
}
]
}GET {{veza_url}}/api/preview/awf/help_page_templates/{{workflow_id}}/{{usage}}GET {{veza_url}}/api/preview/awf/certification_help_page?certification_id={{cert_id}}{
"content": "# Help for Reviewers\n\n## Instructions:\n\n"
}DELETE {{veza_url}}/api/preview/awf/help_page_templates/{{workflow_id}}/{{usage}}{
"value": {
"name": "Global Sign Off Confirmation",
"template_body": "string",
"workflow_id": "00000000-0000-0000-0000-000000000000",
"usage": "SIGN_OFF"
}
}{
"export_id": "019abd80-a80a-7601-b97d-2dfb6b3a35d1"
}curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"format": 0,
"certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
"title": "Access Review Export"
}'curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"format": 0,
"certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
"mutable_filter": "decision eq \"RESULT_DECISION_REJECTED\"",
"title": "Rejected Access"
}'curl -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d '{
"format": 6,
"certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
"previous_certification_id": "a1234abc-1234-5678-9abc-def123456789",
"title": "Access Changes"
}'{
"value": {
"id": "019abd80-a80a-7601-b97d-2dfb6b3a35d1",
"state": "FINISHED",
"created_by": "59fd8ac9-26d8-4d06-aa98-c66c2da0e822",
"created_at": "2025-11-26T00:11:56.810394292Z",
"updated_at": null,
"finished_row_count": 0,
"format": "CSV",
"error_reason": "",
"title": "Test Export",
"last_completed_export": "2025-11-26T00:11:57.513887Z"
}
}curl "$VEZA_URL/api/preview/awf/exports/access_review/019abd80-a80a-7601-b97d-2dfb6b3a35d1" \
-H "authorization: Bearer $VEZA_TOKEN"curl "$VEZA_URL/api/preview/awf/exports/access_review/019abd80-a80a-7601-b97d-2dfb6b3a35d1:download" \
-H "authorization: Bearer $VEZA_TOKEN" \
-o access_review_export.csv#!/bin/bash
set -e
VEZA_URL="${VEZA_URL}"
VEZA_TOKEN="${VEZA_TOKEN}"
CERT_ID="${1}"
# Create export
EXPORT_RESPONSE=$(curl -s -X POST "$VEZA_URL/api/preview/awf/exports/access_review:create" \
-H "authorization: Bearer $VEZA_TOKEN" \
-H "content-type: application/json" \
-d "{\"format\": 0, \"certification_id\": \"$CERT_ID\"}")
EXPORT_ID=$(echo "$EXPORT_RESPONSE" | grep -o '"export_id":"[^"]*"' | cut -d'"' -f4)
echo "Export created: $EXPORT_ID"
# Poll for completion
while true; do
STATUS=$(curl -s "$VEZA_URL/api/preview/awf/exports/access_review/$EXPORT_ID" \
-H "authorization: Bearer $VEZA_TOKEN" | grep -o '"state":"[^"]*"' | cut -d'"' -f4)
echo "Status: $STATUS"
[ "$STATUS" = "FINISHED" ] && break
[ "$STATUS" = "FAILED" ] && echo "Export failed" && exit 1
[ "$STATUS" = "CANCELLED" ] && echo "Export cancelled" && exit 1
[ "$STATUS" = "EXPIRED" ] && echo "Export expired" && exit 1
sleep 5
done
# Download
curl -s "$VEZA_URL/api/preview/awf/exports/access_review/$EXPORT_ID:download" \
-H "authorization: Bearer $VEZA_TOKEN" \
-o "export_${CERT_ID}.csv"
echo "Downloaded: export_${CERT_ID}.csv"{
"format": 0,
"certification_id": "abc123",
"mutable_filter": "decision eq \"RESULT_DECISION_NONE\"",
"order_by": "source.name ASC"
}