This setting is configurable on the Access Reviews > Settings page. Enable Reject incomplete rows to reject and sign off on undecided rows when a review expires.

This API allows you to change the behavior when a review expires (which can be enabled in Review Auto-Complete Settings). Depending on the behavior, incomplete rows can be auto-rejected when the review deadline passes.

Review expiration behavior can be configured globally, or for all reviews for a single Review Configuration, specified by workflow_id in the request.

Request Structure

The request body must include a setting object with the following structure:

{
  "workflow_id": "string",
  "setting": {
    "behavior": 0,
    "note_to_add": "string"
  }
}

Parameters

Where:

• workflow_id (string, optional): Specific review configuration ID. If omitted, applies globally to all reviews.

• setting.behavior (integer): The expiration behavior mode:

  • 0 = DO_NOTHING: No action is made on incomplete rows (default)

  • 1 = AUTO_REJECT_INCOMPLETE_RESULTS

• setting.note_to_add (string, optional): Note to be added when auto-rejecting incomplete results

Example request:

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Parameters

accept_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

reject_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

approve_and_sign_off_button_behavior can be:

• HIDE_OR_SHOW_BEHAVIOR_UNKNOWN = 0

• SHOW = 1

• HIDE = 2

diff_dropdown_behavior can be:

• NORMAL = 1 (Enables all users to see decisions and access changes from previous reviews for the same configuration)

• ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE = 2 (Prevents users with the "Access Reviewer" role from accessing this option)

API reference for the Action Allow List feature. For configuration guidance and how it works, see Action Allow List.

Role Requirements

Both users and groups can be added to the allow list. A user is permitted if their user ID is directly on the list, or if any Veza group they belong to is on the list.

Each principal is specified as an object with a type and id:

All IDs must be Veza internal UUIDs. Email addresses and usernames are not supported.

To look up a user's UUID:

• Administration console: Go to Administration > Users, click the user's name, and copy the UUID from their profile page.

• Users API: Use the to list users and locate the id field in the response.

To look up a group's UUID:

• Groups API: Use GET /api/private/groups to list groups and locate the id field for the target group. Use the filter query parameter to narrow by name (e.g., ?filter=name eq 'Your Group Name').

The allowed_action field controls which restricted operations the principal is permitted to perform. Specify one or more values:

GET /api/private/workflows/access/settings/action_allowlist_enabled

Returns the current enabled state of the allow list.

Example:

Response:

PUT /api/private/workflows/access/settings/action_allowlist_enabled

Enable or disable the allow list globally. When disabled, existing RBAC governs access to all review operations.

Request body:

Set enabled to true to enable or false to disable.

Example (enable):

Example (disable):

POST /api/private/workflows/access/action_allowlist

Add one or more users or groups to the allow list. A single request can include multiple principals of mixed types.

Request body:

Example (add a user for both actions):

Example (add a group):

POST /api/private/workflows/access/action_allowlist:delete

Remove one or more principals from the allow list. Uses the same request shape as the add endpoint.

Request body:

Example:

GET /api/private/workflows/access/action_allowlist

Returns all users and groups currently on the allow list. Each entry represents one principal–action pair; a principal with two allowed actions appears as two separate entries.

Example:

Response:

GET /api/private/workflows/access/action_allowlist/{user_id}

Returns the resolved allowed actions for the specified user, including permissions inherited from group memberships. Pass a user UUID — passing a group UUID will return an empty allowed_actions array rather than an error.

Example:

Response:

Returns an empty array if the user is not on the list and belongs to no permitted groups.

Configure whether due dates are required when creating or editing access reviews. When enabled, review creators must specify a due date before creating a review.

This setting can be configured globally or per-workflow. When a workflow-specific setting is applied, it overrides the global setting for reviews created from that Review Configuration.

Parameters

The setting accepts an object with boolean fields for each review level:

Enable mandatory due dates for first-level reviews only:

Enable mandatory due dates for all review levels:

Example cURL request (global setting):

Example cURL request (workflow-specific setting):

Returns Access Graph relationships for a certification result, including intermediate role details and accumulated permissions.

Parameters

Omit snapshot_id to get the most recent access graph. Specify the snapshot_id of the original certification to show relationships at the time of certification.

Request

Response

The out_edges of each node will contain the IDs of other directly connected nodes. For example, if "OktaUser" is connected to two "OktaGroup" nodes G1 and G2, the user's out-edges will be [{G1}, {G2}]. The node id for each connected node will be included in the response, as well as the status of the relevant data sources, for example:

Enable or disable self-review prevention. When self-review prevention is enabled, users are prevented from being assigned as reviewers for rows that relate to their own access and permissions.

Parameters

The value can be either an integer or string:

• SELF_REVIEWER_CHECKING_DISABLED = 1 (or "SELF_REVIEWER_CHECKING_DISABLED" as string)

• SELF_REVIEWER_CHECKING_ENABLED = 2 (or "SELF_REVIEWER_CHECKING_ENABLED" as string)

An optional workflow_id parameter allows configuring self-review prevention per review configuration, overriding the global setting for that configuration. When workflow_id is omitted, the request reads or writes the global setting.

Example using string value (global):

Example using integer value (global):

Example enabling self-review prevention for a specific review configuration:

When a workflow_id is provided on a GET request, Veza returns the configuration-specific setting if one exists, or falls back to the global setting.

Example GET request (per review configuration):

Example cURL request (global):

Example cURL request (per review configuration):

Controls whether users acting as assigned reviewers can reassign rows to other reviewers.

• When enabled (the default), any user assigned as a reviewer on specific rows can reassign those rows.

• When disabled, assigned reviewers cannot reassign rows.

• Administrators, Operators, and Reassigners always retain reassignment privileges, regardless of this setting.

This setting can be configured globally for all reviews, or for specific review configurations by workflow_id parameter.

The fallback precedence is:

• configuration-specific setting → global setting → default (ALLOWED).

The request body accepts:

• value (string) — ALLOWED or NOT_ALLOWED

• workflow_id (optional string) — Specific review configuration ID to override global settings

Example request to disable reviewer reassignment globally:

Example request to disable reviewer reassignment for a specific review configuration:

Retrieve the current reviewer reassignment setting. Include the optional workflow_id query parameter to get the setting for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Update the reviewer reassignment setting globally or for a specific review configuration. Requires Admin or Operator role.

Global Settings Request:

Configuration-Specific Request:

Example response:

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

Parameters

The request body accepts:

• allow_csv_exports (boolean) - Enable or disable CSV export functionality for reviewers

• allow_pdf_exports (boolean) - Enable or disable PDF export functionality for reviewers

• workflow_id (optional string) - Specific review configuration ID to override global settings

Example request body:

Retrieve the current reviewer export permission settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Update the reviewer export permission settings globally or for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

An Admin or Operator user can complete a review by clicking the "Complete Review" button.

Once a review is marked as "completed," it becomes read-only and is no longer visible to reviewers. By default, a review can be completed when all rows have a signed-off decision.

This API allows you to modify this behavior, enabling a review to be completed at any time, or only when all rows are signed off with a non-rejected decision. The latter option is useful if your organization prefers to complete reviews only after all rejected access has been remediated.

Parameters

Possible values are:

• COMPLETION_ALLOWED_UNKNOWN = 0

• COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION = 1 (Review can be completed only when all result rows have a decision)

• COMPLETION_ALLOWED_ANYTIME = 2 (Review can be completed any time)

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be "expired" when it becomes overdue. An expired review is read-only and is not shown to reviewers.

Parameters

The value can be True or False.

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Enable or disable the "auto-complete" feature. When auto-complete is enabled, a review will automatically be completed once all rows have a signed-off decision, or a non-rejected signed-off decision, depending on the "Completion Allowed Settings."

Parameters

Possible values are:

• AUTO_COMPLETE_UNKNOWN

• AUTO_COMPLETE_ENABLED

• AUTO_COMPLETE_DISABLED

By default, when a review is created, a user can optionally view the status of the data sources involved in the review. This API allows the behavior to change, requiring that the data source status is shown to the user and acknowledged during review creation.

Parameters

Possible values are:

• DATASOURCE_ACKNOWLEDGEMENT_UNKNOWN = 0

• DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN = 1

• DATASOURCE_ACKNOWLEDGEMENT_REQUIRED = 2

Configure the default order in which review rows are displayed. Note: Users can later sort the rows as they prefer.

The order is specified using a SCIM "order by" expression. The default value is source.type asc.

Valid Values

Valid values include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• idp.ATTR

Where ATTR is an attribute name such as "id" or "name".

Configure the default page size for the Access Reviews reviewer interface — the number of ungrouped rows shown per page when a reviewer first opens a review. When this setting is unset, reviews open at the standard default page size.

The configured value applies to the ungrouped results view the first time a reviewer opens a review. Reviewers can still change the number of rows shown per page for the review they are working in at any time.

Parameters

The value is an integer from 10 to 500, specifying the number of rows shown per page.

Example

{
    "value": 100
}

Get Default Review Page Size

Set Default Review Page Size

View or change the deny list for reviewer auto assignment.

Adding a user to the deny list will prevent that user from being auto assigned as a reviewer. That user will also be prevented from appearing in the drop-down menu when manually reassigning a user.

If a user's manager is on the deny list when auto assignment occurs, the certification will be assigned to the that manager's manager. If both the manager and the manager's manger are on the deny list, the result will be assigned to the workflow creator.

Returns the current denied users.

Updates webhook status and details for a certification result.

If you have configured a custom webhook to conduct automated access removal or another form of remediation, you can update Veza with the notification status.

Your application can use this endpoint to send a POST request updating the webhook state, visible to other reviewers from Veza's Certification UI.

This endpoint can also be called during the 7-day grace period after a certification completes or expires. Calls during the grace period require the admin, Access Reviews Admin, or operator role.

Configure predefined notes as menu options when reviewers approve or reject rows. This feature can be configured globally for all reviews or specifically for individual review configurations. When configured for a specific review configuration (using workflow_id), those settings override any global predefined notes.

The predefined notes appear as selectable options in the notes dialog when making decisions, suggesting standardized responses alongside free-form text entry.

The request body accepts:

• reject_notes: Array of predefined note options shown when rejecting rows

These endpoints enable listing workflows, listing certifications, getting certification results, and updating certifications. They can be used to programmatically retrieve workflow and certification details, and update certification rows with a decision or note, such as ticket number.

These endpoints also provide utility functionality, such as managing the reviewer deny list, populating results with webhook response info, and customizing quick filters, smart actions, and help pages.

Duplicates an existing access review configuration and assigns it a new name. Note that the API path uses the older term workflow. In the Veza UI, these are called configurations — as shown on the Access Reviews > Configurations page.

The clone inherits the source configuration's:

• Query and scope

• Notifications and Veza Actions

Returns information about all users assigned to a certification and its results. This will include the users' email and ID, along with their progress on the certification (row_stats listing actions counts by type).

Parameters

A successful response returns AccessReviewerInfo objects within a values array:

Configure the ordered list of fallback selection methods that Veza uses when a valid reviewer cannot be assigned. When all specified reviewers are prevented from assignment (due to self-review prevention, the reviewer deny list, or missing managers/owners), Veza evaluates each selection method in order until an allowed alternate reviewer is found.

For more information, see .

The selection_methods array accepts integer or string values representing fallback methods to enable. Enabled methods are evaluated in the specified order.

List, create, and delete saved filters, globally or for a single workflow. Reviewers can pick from available quick filters under Certification Filters > Saved Filters.

Requests require a for authentication.

Add a quick filter by specifying an optional workflow_id and a single source or destination node property, corresponding to a Review interface column.

Filters can also apply to abstract_permissions or concrete_permissions (see example response).

Valid filter operators are:

• co "contains"

• eq "equals"

• ne "not equals"

With a workflow_id specified, the filter will only apply to certifications on that workflow. Otherwise, reviewers can apply the quick filter to any certification:

A successful response will contain the filter id, for example:

Including a workflow_id in the query returns quick filters with a matching workflow_id and quick filters with no workflow_id:

Example response:

ForceUpdateAwfResults allows administrators to modify results more than normally allowed, such as changing sign-off status, or changing a row's decision after a certification expires.

The API token used for this request must be created for a user with the role.

A forced update request:

• Can undo sign-off of a row.

• On an expired or completed certification, during the grace period, rows can be modified as normal (Assuming they're no longer signed off).

  • The grace period for changes is 7 days after certification completion or expiration

A :

• Can't undo sign-off of a row.

• On an expired or completed certification, during the grace period, the following updates are allowed for admin, Access Reviews Admin, and operator roles:

  • Mark a rejected row as Fixed

  • Update row notes

A successful response will be empty:

Define filter-based actions that reviewers can apply to certifications results with a matching attribute or status.

Reviewers can view and apply custom actions from the Review interface by clicking Smart Action > Prepared Actions.

• Add smart action definition

  • Mutable fields and mutable filters

Create a smart action definition, globally or for a single Workflow.

A certification includes all source and destination node properties discovered or added by Veza. You can specify a SCIM filter to select the results to affect, for example:

Example request:

The filter can apply to any source or destination node property.

When apply_to_all_rows is true and no other filter criteria is specified, the action will run on all certification results.

Mutable fields contain result attributes that are not sourced from Access Graph metadata. Use mutable_fields to apply changes to a result, and mutable_filter to filter results based on decision or sign-off state:

Delete a prepared action by definition id.

Returns an array of smart action definitions. By default, this endpoint lists all definitions. If a workflow_id is specified, only definitions for that workflow are included in the response.

Alter a smart action definition by specifying the id and an array of values to change.

Use column name overrides to customize the display names of columns in the reviewer interface. For example, you can rename source.department to "Business Unit" or destination.name to "Application" to better match your organization's terminology.

Overrides can be configured globally (applying to all reviews) or scoped to a specific review configuration by providing a workflow_id. Workflow-specific overrides take precedence over global overrides.

Parameters

GET /api/private/workflows/access/global_settings/column_name_overrides

PATCH /api/private/workflows/access/global_settings/column_name_overrides

DELETE /api/private/workflows/access/global_settings/column_name_overrides

Remove column name overrides. Optionally specify field_names to clear specific overrides, or omit to clear all overrides for the given scope.

Configure default grouping behavior for access review rows. When enabled, review rows are automatically organized by the specified column values, making it easier for reviewers to process large datasets by grouping related items together.

The setting allows admins to configure a default group by column and collapsed/expanded behavior, either globally or per-workflow.

Parameters

GET /api/private/workflows/access/global_settings/rows_group_by_setting

PUT /api/private/workflows/access/global_settings/rows_group_by_setting

• destination.veza_unique_name - Group by resource name

• source.veza_unique_name - Group by identity name

• status - Group by review status

This setting provides granular control over bulk operations in Access Reviews. With it, administrators can selectively disable specific actions, based on organizational security policies and compliance requirements.

When a bulk action is enabled (all actions are enabled by default), reviewers choose the action to multiple rows at once using row selection, "Select All", or filter-based operations. When disabled, the specified action is hidden from the reviewer interface, for any operations affecting two or more rows.

All fields default to true (all bulk actions allowed). This setting can be configured globally for all reviews, or for specific review configurations by workflow_id parameter.

The fallback precedence is:

• configuration-specific setting → global setting → default (all enabled).

The request body accepts:

• allow_bulk_approve (boolean) - Enable or disable bulk approve for reviewers

• allow_bulk_reject (boolean) - Enable or disable bulk reject for reviewers

• allow_bulk_signoff (boolean) - Enable or disable bulk sign-off for reviewers

Example request body to disable bulk approve and reject globally while keeping other bulk actions enabled:

Example request body to disable all bulk actions for a specific review configuration:

Retrieve the current reviewer bulk actions settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Update the reviewer bulk actions settings globally or for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

This API configures the default columns which reviewers will see when they open a review, as well as columns that should be hidden from reviewers but visible to administrators. If workflow_id is specified then the configuration will only be applied to reviews related to the particular Review Configuration identified by workflow_id.

The request body includes two main fields:

• default_ordered_columns: Array of column names that will be visible to all users (reviewers, administrators, and operators)

• hide_from_reviewers_columns: Array of column names that will be hidden from users with the reviewer role but remain visible to administrators and operators

Important validation rules:

• Column names cannot appear in both default_ordered_columns and hide_from_reviewers_columns simultaneously

• Column names cannot be empty strings

• Column names cannot contain spaces or commas

The valid values to show entity attributes include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR