1 of 42

Access Reviews APIs

Methods for interacting with workflows and certifications

These endpoints enable listing workflows, listing certifications, getting certification results, and updating certifications. They can be used to programmatically retrieve workflow and certification details, and update certification rows with a decision or note, such as ticket number.

These endpoints also provide utility functionality, such as managing the reviewer deny list, populating results with webhook response info, and customizing quick filters, smart actions, and help pages.

Core Workflow Operations

List Workflows

APIs for Veza Access Reviews are subject to change, and as such are provided with the /preview API collection. Use the appropriate prefix when calling the API, for example, your-org.vezacloud.com/api/preview/.

First, save your and Veza base URL as environment variables:

Get all workflows and IDs:

Use a workflow id to get active and pending certifications for that workflow:

The response will include certification details, including the certification ids.

Using a certification id, you can get results for the certification, including entity attributes:

Update a certification result row with a note:

Update Review Configuration

Update the configuration of an existing access review workflow.

Update the configuration of an existing access review workflow. Use this endpoint to modify the workflow name, description, query settings, webhook actions, notification policies, and access revocation behavior.

Method

Endpoint

Force Update Result

Update a single result with escalated privileges

ForceUpdateAwfResults allows administrators to modify results more than normally allowed, such as changing sign-off status, or changing a row's decision after a certification expires.

Method

syntax

Update Webhook Info

Update status info for custom webhooks

Updates webhook status and details for a certification result.

If you have configured a custom webhook to conduct automated access removal or another form of remediation, you can update Veza with the notification status.

Your application can use this endpoint to send a POST request updating the webhook state, visible to other reviewers from Veza's Certification UI.

This endpoint can also be called during the 7-day grace period after a certification completes or expires. Calls during the grace period require the admin, Access Reviews Admin, or operator role.

Method

syntax

Path parameters

certification_id - id of the certification containing the result to update.

Body

The request body must include the id of the result to update. Valid notification_status are:

PENDING
SUCCEED
FAILED

Webhook_info strings can contain up to 255 bytes.

Response

A successful response will be empty {}

Manage Reviewer Deny List

Prevent auto assignment for specific users

View or change the deny list for reviewer auto assignment.

Adding a user to the deny list will prevent that user from being auto assigned as a reviewer. That user will also be prevented from appearing in the drop-down menu when manually reassigning a user.

If a user's manager is on the deny list when auto assignment occurs, the certification will be assigned to the that manager's manager. If both the manager and the manager's manger are on the deny list, the result will be assigned to the workflow creator.

Get Deny List

Returns the current denied users.

Method

syntax

Example response:

Add a user, either a or an identity from a .

Note: To get the user_type for a Veza system user, as well as the user_id, email, and name, view network traffic in the browser while while searching for the user in a reviewer selection drop-down.

Method

syntax

Example body:

Delete an entry on the deny list.

Method

syntax

Example body:

Quick Filters

Customizing saved filters for certification reviewers.

List, create, and delete saved filters, globally or for a single workflow. Reviewers can pick from available quick filters under Certification Filters > Saved Filters.

Method

Syntax

GET, POST, DELETE

{Veza URL}/api/preview/awf/quick_filters

Requests require a for authentication.

Add a quick filter by specifying an optional workflow_id and a single source or destination node property, corresponding to a Review interface column.

Filters can also apply to abstract_permissions or concrete_permissions (see example response).

Valid filter operators are:

co "contains"
eq "equals"
ne "not equals"

With a workflow_id specified, the filter will only apply to certifications on that workflow. Otherwise, reviewers can apply the quick filter to any certification:

A successful response will contain the filter id, for example:

Including a workflow_id in the query returns quick filters with a matching workflow_id and quick filters with no workflow_id:

Example response:

Smart Action Definitions

Define filter-based actions that reviewers can apply to certifications results with a matching attribute or status.

Reviewers can view and apply custom actions from the Review interface by clicking Smart Action > Prepared Actions.

Delegate Reviewers

Configure delegate Veza users who will be assigned as certification reviewers whenever a specified user would have been assigned.

Method

Operation

syntax

GET

List User Delegations

/api/preview/awf/delegation/users

Administrators can configure delegate reviewers for who would otherwise be assigned or auto-assigned to certification results. Specifying a delegate reviewer for another Veza user allows them to fulfill the responsibilities of that user — for example, if a manager is on leave, out-of-office, or otherwise unavailable.

Any certification items assigned to the original reviewer are also assigned to the delegated reviewer.
Delegate reviewers are notified of the assignment and receive notifications in place of the original reviewer. They can review and sign-off on any results assigned to the original reviewer.
The original reviewer can still act on results, but will not receive assignment or reminder emails.

The JSON payload contain pairs of original and delegate . You can use to get all the required details for reviewers assigned to a certification.

Add delegation for Veza system users:

A successful response will be empty.

You can map both local Veza users and identities from an .

Add delegation for Okta users (with IdP settings configured):

Note that this assumes the IdP setting are configured to use "idp_unique_id" to correlate identities, as in the Okta example .

A successful response will list all configured delegations, contained in a values array:

To remove delegations, post the configuration to /api/preview/awf/delegation/users:remove.

A successful response will be empty.

List Reviewer Infos

Get all reviewers and details by certification

Method

syntax

Returns information about all users assigned to a certification and its results. This will include the users' email and ID, along with their progress on the certification (row_stats listing actions counts by type).

Get Access Graph

Detailed graph relationships for certification results

Method

syntax

GET

/api/preview/awf/access_graph

Returns Access Graph relationships for a certification result, including intermediate role details and accumulated permissions.

Parameters

Name

Type

Description

Req.

Omit snapshot_id to get the most recent access graph. Specify the snapshot_id of the original certification to show relationships at the time of certification.

Request

Response

The out_edges of each node will contain the IDs of other directly connected nodes. For example, if "OktaUser" is connected to two "OktaGroup" nodes G1 and G2, the user's out-edges will be [{G1}, {G2}]. The node id for each connected node will be included in the response, as well as the status of the relevant data sources, for example:

Clone Review Configuration

Duplicate an existing access review configuration under a new name, carrying over notifications, Veza Actions, and per-configuration settings.

Overview

Duplicates an existing access review configuration and assigns it a new name. Note that the API path uses the older term workflow. In the Veza UI, these are called configurations — as shown on the Access Reviews > Configurations page.

The clone inherits the source configuration's:

Query and scope
Notifications and Veza Actions
Reviewer experience options — column selection and overrides, default sort order, row grouping, UI customizations, and reviewer export and bulk-action settings
Review behavior — completion and expiration behavior, self-review prevention, mandatory due-date settings, and auto-complete rules
Automation and alerting — digest notifications, review alerts, and any attached automations
Limit Access list, when the (Early Access) feature is enabled on the tenant

In short, any setting you can configure on a configuration in the builder is carried over to the clone.

Any reviews already created from the source configuration are not cloned. The new configuration starts with no reviews. The user calling the endpoint becomes the owner of the new configuration.

Available to users with the Administrator, Access Reviews Admin, or Operator role on the root team.

Use the returned workflow_id to fetch the new configuration with GET /api/private/workflows/access/{workflow_id}, or to update it with subsequent API calls.

Self Review Prevention

Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.

Enable or disable self-review prevention. When self-review prevention is enabled, users are prevented from being assigned as reviewers for rows that relate to their own access and permissions.

Parameters

The value can be either an integer or string:

SELF_REVIEWER_CHECKING_DISABLED = 1 (or "SELF_REVIEWER_CHECKING_DISABLED" as string)
SELF_REVIEWER_CHECKING_ENABLED = 2 (or "SELF_REVIEWER_CHECKING_ENABLED" as string)

An optional workflow_id parameter allows configuring self-review prevention per review configuration, overriding the global setting for that configuration. When workflow_id is omitted, the request reads or writes the global setting.

Example using string value (global):

Example using integer value (global):

Example enabling self-review prevention for a specific review configuration:

When a workflow_id is provided on a GET request, Veza returns the configuration-specific setting if one exists, or falls back to the global setting.

Example GET request (per review configuration):

Example cURL request (global):

Example cURL request (per review configuration):

Review UI Customizations

Customize notes behavior and UI elements for reviewers.

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Parameters

accept_notes_behavior can be:

NOTES_BEHAVIOR_UNKNOWN = 0
NO_POP_UP = 1
POP_UP_OPTIONAL = 2
POP_UP_REQUIRED = 3

reject_notes_behavior can be:

NOTES_BEHAVIOR_UNKNOWN = 0
NO_POP_UP = 1
POP_UP_OPTIONAL = 2

approve_and_sign_off_button_behavior can be:

HIDE_OR_SHOW_BEHAVIOR_UNKNOWN = 0
SHOW = 1
HIDE = 2

diff_dropdown_behavior can be:

NORMAL = 1 (Enables all users to see decisions and access changes from previous reviews for the same configuration)
ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE = 2 (Prevents users with the "Access Reviewer" role from accessing this option)

Review Sort Order

Set default sort order for review rows.

Configure the default order in which review rows are displayed. Note: Users can later sort the rows as they prefer.

The order is specified using a SCIM "order by" expression. The default value is source.type asc.

Valid Values

Valid values include:

source.ATTR
destination.ATTR
waypoint.ATTR
idp.ATTR

Where ATTR is an attribute name such as "id" or "name".

Expire Overdue Reviews

Auto-expire overdue reviews.

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be "expired" when it becomes overdue. An expired review is read-only and is not shown to reviewers.

Parameters

The value can be True or False.

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Reviewer Export Settings

Control export permissions for reviewers.

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

Parameters

The request body accepts:

allow_csv_exports (boolean) - Enable or disable CSV export functionality for reviewers
allow_pdf_exports (boolean) - Enable or disable PDF export functionality for reviewers
workflow_id (optional string) - Specific review configuration ID to override global settings

Example request body:

Retrieve the current reviewer export permission settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Update the reviewer export permission settings globally or for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Reviewer Reassignment Setting

Control whether assigned reviewers can reassign rows to other reviewers.

Controls whether users acting as assigned reviewers can reassign rows to other reviewers.

When enabled (the default), any user assigned as a reviewer on specific rows can reassign those rows.
When disabled, assigned reviewers cannot reassign rows.

Mandatory Due Date Settings

Configure whether due dates are required when creating or editing access reviews.

Configure whether due dates are required when creating or editing access reviews. When enabled, review creators must specify a due date before creating a review.

This setting can be configured globally or per-workflow. When a workflow-specific setting is applied, it overrides the global setting for reviews created from that Review Configuration.

The setting accepts an object with boolean fields for each review level:

Field

Type

Description

{ "nodes": [ { "properties": { "id": "arn:aws:iam::973979857296:role/FederatedS3", "name": "FederatedS3", "type": "AwsIamRole" }, "out_edges": [ { "destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509" } ] }, { "properties": { "id": "0bba9374-d4f5-4c77-93d2-7dfde581fa8a", "name": "Abel_Maclead", "type": "AzureADUser" }, "out_edges": [ { "destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3" } ] }, { "properties": { "id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509", "name": "Read", "type": "AwsIamEffectivePermission" }, "out_edges": [ { "destination_node_id": "arn:aws:s3:::cct-cct02-finance" } ] }, { "properties": { "id": "arn:aws:s3:::cct-cct02-finance", "name": "cct-cct02-finance", "type": "S3Bucket" }, "out_edges": [] } ], "accumulated_effective_permissions": [ "Read" ], "accumulated_raw_permissions": [ "s3:GetObject" ], "datasource_infos": [ { "datasource_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef", "external_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef", "name": "", "last_sync_time": "2022-09-12T22:15:34.874682421Z", "agent_type": "", "has_error": false, "is_deleted": false, "reason": "", "last_error_message": "", "has_warning": false }, { "datasource_id": "", "external_id": "", "name": "", "last_sync_time": "2022-09-12T22:09:47.245436023Z", "agent_type": "", "has_error": false, "is_deleted": false, "reason": "", "last_error_message": "", "has_warning": false } ] }

Access Review Settings

API operations for customizing the behavior and functionality of Veza Access Reviews.

These endpoints can be called by providing a Veza admin user API key. See to generate a bearer token for use in requests. Note that API operations in the private namespace are subject to change as features are added or modified.

Use these APIs to configure Access Reviews Settings for Veza Access Reviews, or to operate on a specific Review Configuration.

Per-configuration operations

Clone Review Configuration: Duplicate an existing access review configuration under a new name, carrying over notifications, Veza Actions, and per-configuration settings.

Global settings

The settings that can be configured by a Veza administrator are:

Review Auto-Complete Settings: Automatically complete reviews once all rows have a signed-off decision, or a non-rejected signed-off decision.
: Enable review completion at any time, or only when all rows are signed off with a non-rejected decision.
: Require review creators to view and acknowledge the data source status shown at review creation.
: Enable or disable expiration of overdue reviews.
: Reject and sign off incomplete rows when a review expires.
: Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.
: Configure default columns which reviewers will see when they open a review.
: Set whether notes are required when approving or rejecting access.
: Set the default sort order and sorting column when opening a review.
: Set the default number of ungrouped rows shown per page when a reviewer opens a review.
: Add suggested notes as menu options when reviewers approve or reject rows.
: Configure default grouping behavior for review rows to organize data by column values.
: Configure outlier detection to identify anomalous access patterns by comparing users to peer groups (Early Access, API-only).
: Control whether reviewers can export review data to CSV or PDF formats.
: Control which bulk actions (approve, reject, sign off, clear decisions, add note, reassign) are available to reviewers.
: Configure whether due dates are required when creating or editing access reviews.
: Customize column display names in the reviewer interface to match your organization's terminology.
: Configure the fallback reviewer selection methods used when a valid reviewer cannot be assigned (Early Access).
: Restrict which users can delete in-progress reviews or modify their due dates, independent of their Veza role.

For each endpoint, a GET request returns the current setting, and a PUT request updates the setting. Use your unique Veza URL and API key (see ) in your request, for example:

Use the Postman collection as an alternative to cURL commands for testing and configuring Veza Access Reviews global settings:

To import the collection into Postman:

Open Postman and click Import in the sidebar
In the Import modal, click Choose Files
Select the access-reviews-global-settings.postman_collection.json file

Before using the collection, configure these required variables on the Variables tab:

Variable

Description

Example

The collection uses Bearer token authentication. Your apiToken variable automatically populates the Authorization header for all requests.

{ "values": [ { "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f", "name": "demo", "description": "demo", "owner": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "notes": "", "query": { "raw_permissions": null, "effective_permissions": null, "source_node_types": { "nodes": [ { "node_type": "GoogleWorkspaceUser", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "required_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "avoided_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "destination_node_types": { "nodes": [ { "node_type": "GoogleCloudProject", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "no_relation": false, "snapshot_id": "1690354800", "waypoint_node_types": { "nodes": [ { "node_type": "GoogleCloudIamRoleBinding", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "path_summary_node_types": null, "node_relationship_type": "CONFIGURED", "include_all_source_tags_in_results": true, "include_all_destination_tags_in_results": false, "page_size": "0", "page_token": "" }, "creator": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "created_at": "2023-07-27T03:34:56.166550127Z" }, { "workflow_id": "baecbd47-bd3d-4d52-acb8-34840a8973b2", "name": "Azure PS", "description": "", "owner": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "notes": "", "query": { "raw_permissions": null, "effective_permissions": null, "source_node_types": { "nodes": [ { "node_type": "Principal", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "required_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "avoided_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "destination_node_types": { "nodes": [ { "node_type": "AzureDataLakeFilesystem", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "no_relation": false, "snapshot_id": "1675900800", "waypoint_node_types": null, "path_summary_node_types": { "nodes": [ { "node_type": "AzureADGroup", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null }, { "node_type": "ActiveDirectoryGroup", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null }, { "node_type": "AzureRoleAssignment", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null }, { "node_type": "AzureAssignmentPermissions", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "node_relationship_type": "CONFIGURED", "include_all_source_tags_in_results": false, "include_all_destination_tags_in_results": false, "page_size": "0", "page_token": "" }, "creator": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "created_at": "2023-02-09T03:07:24.458473708Z" } ] }

{ "value": { "result_id": 0, "source": { "aliases": [], "created_at": "2023-05-03T14:25:43Z", "datasource_id": "datasource:google_cloud_workspace", "email_addresses": [ "jdoe@cookiebeta.ai", "jdoe@cookiebeta.ai.test-google-a.com", "jdoe@veza.com" ], "full_admin": false, "google_cloud_organization_name": "organizations/123456789012", "guest": false, "id": "datasource:112655590859538682841", "idp_unique_id": "jdoe@cookiebeta.ai", "is_active": true, "last_login_at": "2023-05-10T15:25:04Z", "location_areas": [], "mfa_enabled": false, "name": "jdoe@cookiebeta.ai", "organization_names": [], "provider_id": "datasource", "suspended": false, "type": "GoogleWorkspaceUser", "tags": [ { "key": "department", "type": "VEZA", "value": "engineering" } ] }, "destination": { "created_at": "2021-11-01T14:23:35Z", "datasource_id": "datasource:google_cloud_iam", "google_cloud_organization_name": "organizations/123456789012", "id": "projects/743979515322", "name": "Dev GCP Project", "parent_id": "organizations/123456789012", "project_id": "striped-graph-330814", "provider_id": "datasource", "type": "GoogleCloudProject", "updated_at": "2022-04-07T22:08:48Z" }, "accumulated_effective_permissions": [], "accumulated_raw_permissions": [ "bigquery.datasets.get", "bigquery.datasets.getIamPolicy", "bigquery.tables.get", "bigquery.tables.getIamPolicy", "bigquery.tables.list", "iam.roles.get", "iam.roles.list", "iam.serviceAccounts.create", "iam.serviceAccounts.list", "resourcemanager.folders.create", "resourcemanager.folders.delete", "resourcemanager.folders.get", "resourcemanager.folders.getIamPolicy", "resourcemanager.folders.list", "resourcemanager.folders.move", "resourcemanager.folders.setIamPolicy", "resourcemanager.folders.undelete", "resourcemanager.organizations.get", "resourcemanager.organizations.getIamPolicy", "resourcemanager.organizations.setIamPolicy", "resourcemanager.projects.create", "resourcemanager.projects.delete", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", "resourcemanager.projects.list", "resourcemanager.projects.move", "resourcemanager.projects.setIamPolicy", "resourcemanager.projects.update", "storage.buckets.create", "storage.buckets.createTagBinding", "storage.buckets.delete", "storage.buckets.deleteTagBinding", "storage.buckets.get", "storage.buckets.getIamPolicy", "storage.buckets.list", "storage.buckets.listTagBindings", "storage.buckets.setIamPolicy", "storage.buckets.update" ], "updated_at": null, "updated_by": null, "signed_off_at": null, "signed_off_by": null, "notification_response_infos": [], "notification_status": "UNKNOWN", "waypoint": { "id": "organizations/123456789012_policy_role_binding0", "name": "CookieAIDevServicePrincipalRole", "type": "GoogleCloudIamRoleBinding" }, "action_log_entries": [], "decision": "NONE", "notes": "", "reviewers": [ { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "External User" } ], "signed_off_state": "NOT_SIGNED_OFF", "reviewer_assignment": null, "joined_nodes": { "idp": { "canonical_name": "Jane Doe", "department": "Engineering", "email": "jdoe@cookiebeta.ai", "identity_type": "HUMAN", "is_active": true, "manager_email": "manager@cookiebeta.ai", "name": "jdoe", "type": "OAA.custom_idp.IDPUser" } } } }

POST /api/preview/awf/smart_action_definitions HTTP/1.1 Host: your-tenant.vezacloud.com Authorization: Bearer YOUR_SECRET_TOKEN Content-Type: application/json Accept: */* Content-Length: 2654 { "name": "text", "description": "text", "workflow_id": "text", "filter": "text", "mutable_fields": { "decision": 1, "notes": "text", "updated_at": "2026-07-22T02:37:42.450Z", "updated_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "notification_infos": { "values": [ { "notification_type": 1, "webhook_type": 1, "status": 1, "error_message": "text", "updated_at": "2026-07-22T02:37:42.450Z", "snow_info": { "ticket_number": "text", "sys_id": "text" }, "webhook_info": { "info": "text" }, "jira_info": { "keys": [ "text" ] }, "slack_app_info": {} } ] }, "notification_status": 1, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "signed_off_state": 1, "signed_off_at": "2026-07-22T02:37:42.450Z", "signed_off_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "action_log": { "entries": [ { "action": 1, "user": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "time": "2026-07-22T02:37:42.450Z", "note": "text", "reviewer_detail": { "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "new_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ] }, "decision_detail": { "decision": 1, "note": "text" }, "decision_cleared_detail": { "previous_decision": 1, "original_decider": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "reason": 1 }, "revocation_request_detail": { "request_id": "text" }, "approval_level": 1 } ] }, "reviewer_assignment": { "users_manager": true, "resource_managers": true, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "fallback_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "reviewers_managers_for_approval_levels": [ 1 ], "previous_review_assignment": true }, "automation_run_ids": [ "text" ], "decision_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "decision_at": "2026-07-22T02:37:42.450Z", "revoke_request_infos": [ { "id": "text", "state": 1, "error_message": "text" } ], "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "predefined_question_response": [ { "question_id": "text", "answer_id": "text", "answer_text": "text" } ], "is_assigned_to_current_user": true, "ai_suggestion": { "suggestion": 1, "reason_codes": [ "text" ], "cohort_id": "text", "cohort_index": 1 }, "itsm_request_number": "text", "itsm_request_status": "text", "itsm_request_url": "text", "itsm_request_last_updated_at": "2026-07-22T02:37:42.450Z" }, "mutable_filter": "text", "apply_to_all_rows": true }

PUT /api/preview/awf/smart_action_definitions HTTP/1.1 Host: your-tenant.vezacloud.com Authorization: Bearer YOUR_SECRET_TOKEN Content-Type: application/json Accept: */* Content-Length: 2676 { "value": { "id": "text", "description": "text", "name": "text", "workflow_id": "text", "filter": "text", "mutable_fields": { "decision": 1, "notes": "text", "updated_at": "2026-07-22T02:37:42.450Z", "updated_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "notification_infos": { "values": [ { "notification_type": 1, "webhook_type": 1, "status": 1, "error_message": "text", "updated_at": "2026-07-22T02:37:42.450Z", "snow_info": { "ticket_number": "text", "sys_id": "text" }, "webhook_info": { "info": "text" }, "jira_info": { "keys": [ "text" ] }, "slack_app_info": {} } ] }, "notification_status": 1, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "signed_off_state": 1, "signed_off_at": "2026-07-22T02:37:42.450Z", "signed_off_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "action_log": { "entries": [ { "action": 1, "user": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "time": "2026-07-22T02:37:42.450Z", "note": "text", "reviewer_detail": { "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "new_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ] }, "decision_detail": { "decision": 1, "note": "text" }, "decision_cleared_detail": { "previous_decision": 1, "original_decider": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "reason": 1 }, "revocation_request_detail": { "request_id": "text" }, "approval_level": 1 } ] }, "reviewer_assignment": { "users_manager": true, "resource_managers": true, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "fallback_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "reviewers_managers_for_approval_levels": [ 1 ], "previous_review_assignment": true }, "automation_run_ids": [ "text" ], "decision_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "decision_at": "2026-07-22T02:37:42.450Z", "revoke_request_infos": [ { "id": "text", "state": 1, "error_message": "text" } ], "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "predefined_question_response": [ { "question_id": "text", "answer_id": "text", "answer_text": "text" } ], "is_assigned_to_current_user": true, "ai_suggestion": { "suggestion": 1, "reason_codes": [ "text" ], "cohort_id": "text", "cohort_index": 1 }, "itsm_request_number": "text", "itsm_request_status": "text", "itsm_request_url": "text", "itsm_request_last_updated_at": "2026-07-22T02:37:42.450Z" }, "mutable_filter": "text", "apply_to_all_rows": true } }

{ "values": [ { "id": "text", "description": "text", "name": "text", "workflow_id": "text", "filter": "text", "mutable_fields": { "decision": 1, "notes": "text", "updated_at": "2026-07-22T02:37:42.450Z", "updated_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "notification_infos": { "values": [ { "notification_type": 1, "webhook_type": 1, "status": 1, "error_message": "text", "updated_at": "2026-07-22T02:37:42.450Z", "snow_info": { "ticket_number": "text", "sys_id": "text" }, "webhook_info": { "info": "text" }, "jira_info": { "keys": [ "text" ] }, "slack_app_info": {} } ] }, "notification_status": 1, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "signed_off_state": 1, "signed_off_at": "2026-07-22T02:37:42.450Z", "signed_off_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "action_log": { "entries": [ { "action": 1, "user": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "time": "2026-07-22T02:37:42.450Z", "note": "text", "reviewer_detail": { "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "new_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ] }, "decision_detail": { "decision": 1, "note": "text" }, "decision_cleared_detail": { "previous_decision": 1, "original_decider": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "reason": 1 }, "revocation_request_detail": { "request_id": "text" }, "approval_level": 1 } ] }, "reviewer_assignment": { "users_manager": true, "resource_managers": true, "reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "fallback_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "reviewers_managers_for_approval_levels": [ 1 ], "previous_review_assignment": true }, "automation_run_ids": [ "text" ], "decision_by": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "decision_at": "2026-07-22T02:37:42.450Z", "revoke_request_infos": [ { "id": "text", "state": 1, "error_message": "text" } ], "old_reviewers": [ { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" } ], "predefined_question_response": [ { "question_id": "text", "answer_id": "text", "answer_text": "text", "respondent_user": { "user_type": "text", "id": "text", "email": "text", "name": "text", "alternate_email": "text" }, "responded_at": "2026-07-22T02:37:42.450Z" } ], "is_assigned_to_current_user": true, "ai_suggestion": { "suggestion": 1, "reason_codes": [ "text" ], "cohort_id": "text", "cohort_index": 1 }, "itsm_request_number": "text", "itsm_request_status": "text", "itsm_request_url": "text", "itsm_request_last_updated_at": "2026-07-22T02:37:42.450Z" }, "mutable_filter": "text", "apply_to_all_rows": true } ] }

{ "values": [ { "result_id": 0, "source": { "aliases": [], "created_at": "2023-05-03T14:25:43Z", "datasource_id": "datasource:google_cloud_workspace", "email_addresses": [ "jdoe@cookiebeta.ai", "jdoe@cookiebeta.ai.test-google-a.com", "jdoe@veza.com" ], "full_admin": false, "google_cloud_organization_name": "organizations/123456789012", "guest": false, "id": "datasource:112655590859538682841", "idp_unique_id": "jdoe@cookiebeta.ai", "is_active": true, "last_login_at": "2023-05-10T15:25:04Z", "location_areas": [], "mfa_enabled": false, "name": "jdoe@cookiebeta.ai", "organization_names": [], "provider_id": "datasource", "suspended": false, "type": "GoogleWorkspaceUser", "tags": [ { "key": "department", "type": "VEZA", "value": "engineering" } ] }, "destination": { "created_at": "2021-11-01T14:23:35Z", "datasource_id": "datasource:google_cloud_iam", "google_cloud_organization_name": "organizations/123456789012", "id": "projects/743979515322", "name": "Dev GCP Project", "parent_id": "organizations/123456789012", "project_id": "striped-graph-330814", "provider_id": "datasource", "type": "GoogleCloudProject", "updated_at": "2022-04-07T22:08:48Z" }, "accumulated_effective_permissions": [], "accumulated_raw_permissions": [ "bigquery.datasets.get", "bigquery.datasets.getIamPolicy", "bigquery.tables.get", "bigquery.tables.getIamPolicy", "bigquery.tables.list", "iam.roles.get", "iam.roles.list", "iam.serviceAccounts.create", "iam.serviceAccounts.list", "resourcemanager.folders.create", "resourcemanager.folders.delete", "resourcemanager.folders.get", "resourcemanager.folders.getIamPolicy", "resourcemanager.folders.list", "resourcemanager.folders.move", "resourcemanager.folders.setIamPolicy", "resourcemanager.folders.undelete", "resourcemanager.organizations.get", "resourcemanager.organizations.getIamPolicy", "resourcemanager.organizations.setIamPolicy", "resourcemanager.projects.create", "resourcemanager.projects.delete", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", "resourcemanager.projects.list", "resourcemanager.projects.move", "resourcemanager.projects.setIamPolicy", "resourcemanager.projects.update", "storage.buckets.create", "storage.buckets.createTagBinding", "storage.buckets.delete", "storage.buckets.deleteTagBinding", "storage.buckets.get", "storage.buckets.getIamPolicy", "storage.buckets.list", "storage.buckets.listTagBindings", "storage.buckets.setIamPolicy", "storage.buckets.update" ], "updated_at": null, "updated_by": null, "signed_off_at": null, "signed_off_by": null, "notification_response_infos": [], "notification_status": "UNKNOWN", "waypoint": { "id": "organizations/123456789012_policy_role_binding0", "name": "CookieAIDevServicePrincipalRole", "type": "GoogleCloudIamRoleBinding" }, "action_log_entries": [], "decision": "NONE", "notes": "", "reviewers": [ { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "External User" } ], "signed_off_state": "NOT_SIGNED_OFF", "reviewer_assignment": null, "joined_nodes": { "idp": { "canonical_name": "Jane Doe", "department": "Engineering", "email": "jdoe@cookiebeta.ai", "identity_type": "HUMAN", "is_active": true, "manager_email": "manager@cookiebeta.ai", "name": "jdoe", "type": "OAA.custom_idp.IDPUser" } } }, { "result_id": 1, "source": { "aliases": [], "created_at": "2023-05-03T14:25:43Z", "datasource_id": "datasource:google_cloud_workspace", "email_addresses": [ "jdoe@cookiebeta.ai", "jdoe@cookiebeta.ai.test-google-a.com", "jdoe@veza.com" ], "full_admin": false, "google_cloud_organization_name": "organizations/123456789012", "guest": false, "id": "datasource:112655590859538682841", "idp_unique_id": "jdoe@cookiebeta.ai", "is_active": true, "last_login_at": "2023-05-10T15:25:04Z", "location_areas": [], "mfa_enabled": false, "name": "jdoe@cookiebeta.ai", "organization_names": [], "provider_id": "datasource", "suspended": false, "type": "GoogleWorkspaceUser" }, "destination": { "created_at": "2021-11-01T14:23:35Z", "datasource_id": "datasource:google_cloud_iam", "google_cloud_organization_name": "organizations/123456789012", "id": "projects/743979515322", "name": "Dev GCP Project", "parent_id": "organizations/123456789012", "project_id": "striped-graph-330814", "provider_id": "datasource", "type": "GoogleCloudProject", "updated_at": "2022-04-07T22:08:48Z" }, "accumulated_effective_permissions": [], "accumulated_raw_permissions": [ "cloudkms.cryptoKeyVersions.create", "cloudkms.cryptoKeyVersions.destroy", "cloudkms.cryptoKeyVersions.get", "cloudkms.cryptoKeyVersions.list", "cloudkms.cryptoKeyVersions.restore", "cloudkms.cryptoKeyVersions.update", "cloudkms.cryptoKeyVersions.useToDecryptViaDelegation", "cloudkms.cryptoKeyVersions.useToEncryptViaDelegation", "cloudkms.cryptoKeys.create", "cloudkms.cryptoKeys.get", "cloudkms.cryptoKeys.getIamPolicy", "cloudkms.cryptoKeys.list", "cloudkms.cryptoKeys.setIamPolicy", "cloudkms.cryptoKeys.update", "cloudkms.keyRings.create", "cloudkms.keyRings.createTagBinding", "cloudkms.keyRings.deleteTagBinding", "cloudkms.keyRings.get", "cloudkms.keyRings.getIamPolicy", "cloudkms.keyRings.list", "cloudkms.keyRings.listTagBindings", "cloudkms.keyRings.setIamPolicy", "cloudkms.locations.get", "cloudkms.locations.list", "resourcemanager.projects.get" ], "updated_at": null, "updated_by": null, "signed_off_at": null, "signed_off_by": null, "notification_response_infos": [], "notification_status": "UNKNOWN", "waypoint": { "id": "organizations/123456789012_policy_role_binding11", "name": "cloudkms.admin", "type": "GoogleCloudIamRoleBinding" }, "action_log_entries": [], "decision": "NONE", "notes": "", "reviewers": [ { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "External User" } ], "signed_off_state": "NOT_SIGNED_OFF", "reviewer_assignment": null } ], "next_page_token": "EAI=", "has_more": true, "has_previous": false }

Automations API

Get, create, update, delete, and attach Intelligent Automations.

Use these operations to manage Access Review Automations and associate them with individual workflows.

Automations apply changes (such as approve, sign-off, add a note, or apply visual indicators) to Certification rows based on historical certification data, or a filter on the current results. They can run by default or on an opt-in basis when a certification is created.

Example Automations

{
  "id": "e48dd2c8-3633-463b-a477-0177a942b5a6",
  "name": "Highlight inactive sources",
  "description": "Highlight rows where the source account is inactive",
  "priority": 0,
  "attachment_behavior": {
    "attach_to_new_workflows": true,
    "opt_in": true
  },
  "criteria": {
    "filter": "source.is_active eq false",
    "mutable_filter": ""
  },
  "action": {
    "display_style": "HIGHLIGHT",
    "display_text": "Source account is inactive",
    "highlight_color": "#FF6B35"
  }
}

{
  "id": "f59ee3d9-4744-574c-b588-1288b0942c7c",
  "name": "Reject privileged account access",
  "description": "Suggest reject for admin or root accounts",
  "priority": 0,
  "attachment_behavior": {
    "attach_to_new_workflows": true,
    "opt_in": true
  },
  "criteria": {
    "filter": "(destination.name eq \"admin\") OR (source.name eq \"root\")",
    "mutable_filter": ""
  },
  "action": {
    "display_style": "SUGGEST_REJECT",
    "display_text": "Privileged account detected - review carefully"
  }
}

For more information about this feature see Intelligent Automations.

You will need an API token with root team or administrator permissions to manage Automations.

Key Concepts

When working with the Automations API, it is important to understand the relationship between three identifiers:

ID Type

Description

Scope

At an API level,

An Automation is a reusable rule that can be attached to one or more Workflows
A Workflow (review configuration) defines how reviews are created and can have multiple Certifications over time
A Certification is a single instance of a review where Automations run against the results

The following rules apply when an Automation run encounters an issue:

If Automation processing fails for any result, the Automation run stops and no further Automations are applied.
When Automations fail, the Certification is still considered complete and non-errored. The Automation run will have an error status and message.

Results are considered the same when the entities and relationships are exactly equal (including data source IDs). If a conflict occurs with Automations trying to change the same mutable field:

Each change must update the field to the same value. The action log entry will contain notes (if supplied) for each action.
Automations changing a field to differing values are unresolvable conflicts and skipped, but will not interrupt the Automation run.

An Automation consists of attachment_behavior rules, filter criteria, and an action to apply:

Each Automation object has the fields:

id (String): Unique identifier for the Automation.
name (String): Name of the Automation.
description

Defines if the Automation is available for all workflows, and whether it is optional:

attach_to_new_workflows (Boolean): Indicates whether to automatically attach to new and existing workflows.
opt_in (Boolean): If true Operators can pick the automation when creating a Workflow. If false the automation is enabled by default.

Specifies filters for conditionally updating results:

filter (String): A SCIM filter specifying a source or destination attribute with support for complex expressions using AND, OR, and parentheses for grouping. Examples:
- Simple filter: source.is_active eq false
- Complex filter: (source.name sw "A" OR source.name sw "B") AND destination.is_active eq true

Similarly to Smart Actions, Automations can update results based on a source or destination attribute (such as activity status). Filters use the syntax source.attribute or destination.attribute.

The filter field in an Automation's criteria accepts a SCIM-style expression. Each filter field referenced in the expression is either a bare field or a two-part endpoint.field. Filter fields with three or more dot-separated segments (for example, source.tags.value, reviewers.id, or decision.by) are invalid and are rejected at parse time.

A filter that fails to parse prevents the Automation from running. When multiple Automations are attached to a Certification, a single unparseable filter on any one of them blocks every attached Automation from running on that Certification.

The endpoint must be one of the following:

Endpoint

Valid fields

Notes on two-part form:

tags matches on the tag key only, never the value. For example, source.tags eq "owner" matches any source node carrying a tag whose key is owner, regardless of that tag's value.
Use the exact property key as stored on the node. Built-in properties use their own name (for example, source.is_active). Customer-ingested custom properties carry the customprop_ prefix that is applied during ingest (for example, source.customprop_attribute_code

Bare fields refer to attributes of the Certification result row itself, not to the source, destination, waypoint, or path-summary nodes. The field must be exactly one of the following:

Outlier Detection

Configure outlier detection settings to identify anomalous access patterns in Access Reviews.

Early Access Feature: Outlier Detection is currently in Early Access and available via API only. The feature and API are subject to change. Contact your Veza Customer Success Manager to enable this feature for your tenant.

Configure outlier detection to automatically identify and flag anomalous access patterns during Access Reviews. The Manager-Centric algorithm compares each user's access to their peer group and detects access held by fewer than a specified threshold percentage of peers, helping reviewers focus on unusual or potentially risky permissions.

How Outlier Detection Works

The Manager-Centric outlier detection algorithm uses statistical analysis to identify rare access patterns:

Peer Grouping: Users are grouped based on configurable properties (default: users sharing the same manager)
Statistical Analysis: For each destination (resource/permission) in the review, Veza calculates what percentage of the peer group has access using the Wilson score confidence interval method at 95% confidence
Threshold Comparison: Access paths where the statistical lower bound is at or below the configured threshold are flagged as outliers
Reviewer Visibility: Flagged items are highlighted in the reviewer interface with explanations indicating the access is rare within the peer group

By default, outlier detection uses:

Grouping: Users with the same manager (manager_idp_unique_id property)
Threshold: 15% (access held by ≤15% of peers is flagged as an outlier)

Consider an Access Review for Okta groups:

100 users report to Manager A
95 of them have access to the "Engineering-All-Hands" group
5 users have access to the "Admin-Production-Access" group

Given a 15% threshold:

"Engineering-All-Hands" access (95% of peers) is not flagged, as this is normal access
"Admin-Production-Access" (5% of peers) is flagged as an outlier, as this is rare access

The reviewer sees a warning on those 5 rows that this access is anomalous within the peer group — no more than 15% of peers with shared characteristics have it.

Administrators can customize outlier detection using APIs:

GET /api/private/workflows/access/global_settings/manager_centric_config

Retrieve the current outlier detection configuration, either globally or for a specific review configuration.

Name

Type

Required

Description

PUT /api/private/workflows/access/global_settings/manager_centric_config

Update the outlier detection configuration globally or for a specific review configuration.

Name

Type

Required

Description

Grouping properties define how users are organized into peer groups for outlier analysis. You can specify properties from:

Source nodes (the users/identities in the review)
Destination nodes (the resources/permissions being reviewed)
Enriched/joined nodes (additional data joined to the query, such as manager information from an IdP)

Each property reference has these fields:

Field

Type

Required

Description

Properties from the source entities in the review (typically users/identities).

Common source properties:

department - User's department
location - User's location
manager_idp_unique_id - User's manager identifier (default)

Example:

Properties from the destination entities (resources/permissions being reviewed).

Common destination properties:

classification - Resource classification level
data_sensitivity - Data sensitivity level
owner - Resource owner

Example:

Properties from enriched/joined metadata from another data source. These require the review query to include a JoinNodeSpec that joins additional data (such as manager information from an IdP).

Example:

This groups all users by their manager's department, requiring the review query to join the manager data with the alias "manager".

Groups users by manager with a 15% threshold (default configuration):

Use case: Identify access that's unusual compared to direct peers reporting to the same manager.

Groups users by both department and location with a 10% threshold:

Use case: Identify access that's rare among users in the same department and office location.

Compares each user to the entire population with 5% threshold:

Use case: Flag extremely rare access across the entire organization, regardless of role or department.

Groups by destination resource classification with a 20% threshold:

Use case: Identify unusual access patterns within resources of the same classification level.

Groups by the manager's department (requires query enrichment) with a 15% threshold:

Use case: Identify access that's unusual among users whose managers are in the same department, useful in matrix organizations.

Scenario: Reviewing access to financial systems where SOX compliance requires attention to outlier access.

Configuration:

Users with access held by ≤5% of their department peers are flagged for additional scrutiny.

Scenario: Reviewing production system access where most engineers shouldn't have admin rights.

Configuration:

Identifies engineers with production access that is unusual within their team, considering the environment.

Scenario: Reviewing access where job role should predict permissions.

Configuration:

Flags access held by ≤15% of users with the same job role, indicating potential role creep or over-provisioning.

Scenario: Detecting access patterns that are unusual for an entire department.

Configuration:

Identifies access held by ≤8% of users in the same department and location, flagging potentially inappropriate cross-functional access.

- Overview of all Access Reviews settings
- Complete Access Reviews documentation

{ "values": [ { "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10", "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f", "query_used": { "raw_permissions": null, "effective_permissions": null, "source_node_types": { "nodes": [ { "node_type": "GoogleWorkspaceUser", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "required_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "avoided_intermediate_node_types": { "nodes": [], "nodes_operator": "AND" }, "destination_node_types": { "nodes": [ { "node_type": "GoogleCloudProject", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "no_relation": false, "snapshot_id": "1690354800", "waypoint_node_types": { "nodes": [ { "node_type": "GoogleCloudIamRoleBinding", "tags": [], "conditions": [], "condition_expression": null, "node_id": "", "excluded_tags": [], "count_conditions": [], "direct_relationship_only": false, "node_type_grouping_constraint": null } ], "nodes_operator": "AND" }, "path_summary_node_types": null, "node_relationship_type": "CONFIGURED", "include_all_source_tags_in_results": true, "include_all_destination_tags_in_results": false, "page_size": "0", "page_token": "" }, "name": "demo", "notes": "", "due_date": "2023-07-30T03:44:00Z", "reviewers": [], "state": "IN_PROGRESS", "snapshot_time": "2023-07-26T07:00:00Z", "started_at": "2023-07-27T03:44:27.260812616Z", "query_completed_at": "2023-07-27T03:44:31.410373279Z", "completed_at": null, "created_by": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "completed_by": null, "results_updated_at": "2023-07-27T03:44:31.410373665Z", "results_updated_by": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "updated_at": "2023-07-27T03:44:31.410413829Z", "updated_by": { "user_type": "localCookieUser", "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8", "email": "cookie@cookie.ai", "name": "earlypreview-auth0" }, "error_reason": "", "expired_at": null, "version": 1, "total_result_count": 2433, "total_complete_count": 0, "total_rejected_count": 0, "total_accepted_count": 0, "total_fixed_count": 0 } ] }

Help Page Templates

Manage custom help pages for Veza Access Reviews.

Use these operations to add and manage help pages for access reviewers, and customize pop-up messages when a review starts, or when rows are signed off.

Operation

Method

Syntax

POST

Add custom help messages for reviewers by providing the plain text template_body, name, and an existing workflow_id and usage where the template will apply. All reviews (certifications) for the configuration (workflow) will use the new template.

The usage field determines how and when the help page will be visible to users. It must be one of the following values:

HELP_PAGE: Reviewers can access help pages from reviewer's interface by clicking the User Guide icon. The help page will also appear when viewing the review for the first time.
REVIEW_START: Opens when reviewers start a review.
SIGN_OFF

Only one help page can exist at a time for a given workflow and usage. You can manage global help pages by using 00000000-0000-0000-0000-000000000000 as the workflow_id. Global help pages for each usage will apply to all reviews for all configurations.

The template can use markdown and placeholders, for example:

See for more information about placeholders.

Example request:

Get all configured help page templates.

Example response:

Returns the current help page template for an existing workflow_id and usage.

The usage parameter must be specified. For the existing help page template, the usage value should be HELP_PAGE.
To retrieve the tenant-wide default template (if it was set), use an all-zero UUID (00000000-0000-0000-0000-000000000000) for the workflow_id.

Example request:

Returns the current template for a given certification id.

Example request:

Example response:

Permanently remove the help page template for a workflow_id and usage. It will no longer apply to reviews for using the configuration, specified by workflow_id.

The usage parameter must be specified. For the existing help page template, the usage value should be HELP_PAGE.
To clear the tenant-wide default template, use an all-zero UUID for the workflow_id: 00000000-0000-0000-0000-000000000000.

Example request:

PUT {{veza_url}}/api/preview/awf/help_page_templates

Update the help page for the specified workflow_id and usage:

To add a tenant-wide default template, use an all-zero UUID for the workflow_id: 00000000-0000-0000-0000-000000000000.
Updating a template now uses a plain text template_body, instead of a base64-encoded string.

Example request:

Access Reviews APIs

Core Workflow Operations

Update Review Configuration

Force Update Result

Update Webhook Info

Manage Reviewer Deny List

Get Deny List

Quick Filters

Smart Action Definitions

Delegate Reviewers

List Reviewer Infos

Get Access Graph

Clone Review Configuration

Overview

Self Review Prevention

Parameters

Review UI Customizations

Parameters

Review Sort Order

Valid Values

Expire Overdue Reviews

Parameters

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Reviewer Export Settings

Parameters

Reviewer Reassignment Setting

Mandatory Due Date Settings

Update Webhook Info

Access Reviews APIs

Core Workflow Operations

List Reviewer Infos

Quick start

Parameters

Examples

Request

Response

Manage Reviewer Deny List

Get Deny List

Review Sort Order

Valid Values

Review UI Customizations

Parameters

Self Review Prevention

Parameters

Clone Review Configuration

Overview

Expire Overdue Reviews

Parameters

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Smart Action Definitions

Add User

Remove User

Example

Get Review UI Customizations

Set Review UI Customizations

Add smart action definition

Mutable fields and mutable filters

Remove a smart action definition

List smart action definitions

Update a smart action definition

Example

Get Review Sort Order

Set Review Sort Order

Examples

Get Self Review Settings

Set Self Review Settings

Permissions

API reference

Example request

Example response

Get Access Graph

Delegate Reviewers

Quick Filters

Reviewer Export Settings

Parameters

Update Review Configuration

Force Update Result

Reviewer Reassignment Setting