View or change the deny list for reviewer auto assignment.

Adding a user to the deny list will prevent that user from being auto assigned as a reviewer. That user will also be prevented from appearing in the drop-down menu when manually reassigning a user.

If a user's manager is on the deny list when auto assignment occurs, the certification will be assigned to the that manager's manager. If both the manager and the manager's manger are on the deny list, the result will be assigned to the workflow creator.

Get Deny List

Returns the current denied users.

Example response:

Add User

Add a user, either a or an identity from a .

Note: To get the user_type for a Veza system user, as well as the user_id, email, and name, view network traffic in the browser while while searching for the user in a reviewer selection drop-down.

Example body:

Remove User

Delete an entry on the deny list.

Example body:

Enable or disable the "auto-complete" feature. When auto-complete is enabled, a review will automatically be completed once all rows have a signed-off decision, or a non-rejected signed-off decision, depending on the "Completion Allowed Settings."

Parameters

Possible values are:

• AUTO_COMPLETE_UNKNOWN

• AUTO_COMPLETE_ENABLED

• AUTO_COMPLETE_DISABLED

Example

Get Review Auto-Complete Settings

Set Review Auto-Complete Settings

ForceUpdateAwfResults allows administrators to modify results more than normally allowed, such as changing sign-off status, or changing a row's decision after a certification expires.

The API token used for this request must be created for a user with the role.

A forced update request:

• Can undo sign-off of a row.

• On an expired or completed certification, during the grace period, rows can be modified as normal (Assuming they're no longer signed off).

  • The grace period for changes is 7 days after certification completion or expiration

A :

• Can't undo sign-off of a row.

• On an expired or completed certification, during the grace period, the following updates are allowed for admin, Access Reviews Admin, and operator roles:

  • Mark a rejected row as Fixed

Parameters

Sample Request

Sample Response

A successful response will be empty:

Administrators can configure delegate reviewers for who would otherwise be assigned or auto-assigned to certification results. Specifying a delegate reviewer for another Veza user allows them to fulfill the responsibilities of that user — for example, if a manager is on leave, out-of-office, or otherwise unavailable.

• Any certification items assigned to the original reviewer are also assigned to the delegated reviewer.

• Delegate reviewers are notified of the assignment and receive notifications in place of the original reviewer. They can review and sign-off on any results assigned to the original reviewer.

• The original reviewer can still act on results, but will not receive assignment or reminder emails.

Examples

Add user delegations

The JSON payload contain pairs of original and delegate . You can use to get all the required details for reviewers assigned to a certification.

Add delegation for Veza system users:

A successful response will be empty.

You can map both local Veza users and identities from an .

Add delegation for Okta users (with IdP settings configured):

Note that this assumes the IdP setting are configured to use "idp_unique_id" to correlate identities, as in the Okta example .

List user delegations

A successful response will list all configured delegations, contained in a values array:

Remove user delegations

To remove delegations, post the configuration to /api/preview/awf/delegation/users:remove.

A successful response will be empty.

Configure the default order in which review rows are displayed. Note: Users can later sort the rows as they prefer.

The order is specified using a SCIM "order by" expression. The default value is source.type asc.

Valid Values

Valid values include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• idp.ATTR

Where ATTR is an attribute name such as "id" or "name".

Example

Get Review Sort Order

Set Review Sort Order

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Parameters

Returns information about all users assigned to a certification and its results. This will include the users' email and ID, along with their progress on the certification (row_stats listing actions counts by type).

This setting is configurable on the Access Reviews > Settings page. Enable Reject incomplete rows to reject and sign off on undecided rows when a review expires.

This API allows you to change the behavior when a review expires (which can be enabled in Review Auto-Complete Settings). Depending on the behavior, incomplete rows can be auto-rejected when the review deadline passes.

Review expiration behavior can be configured globally, or for all reviews for a single Review Configuration, specified by workflow_id in the request.

Configure the ordered list of fallback selection methods that Veza uses when a valid reviewer cannot be assigned. When all specified reviewers are prevented from assignment (due to self-review prevention, the reviewer deny list, or missing managers/owners), Veza evaluates each selection method in order until an allowed alternate reviewer is found.

For more information, see Reviewer Selection Methods.

Parameters

The selection_methods array accepts integer or string values representing fallback methods to enable. Enabled methods are evaluated in the specified order.

Example request body (PUT)

This enables all four fallback methods in order: reviewer's manager, then fallback reviewers, then workflow creator, then admin.

For example, to enable only the first two methods:

With this configuration, Veza will not fall back to the workflow creator or a system administrator. Rows are left unassigned if no valid manager or fallback reviewer exists.

Get Alternate Reviewer Settings

Retrieve current alternate reviewer selection method settings:

Example response:

Set Alternate Reviewer Settings

Update the alternate reviewer selection methods. The order of values in the selection_methods array determines the evaluation order.

Using integer values:

Use column name overrides to customize the display names of columns in the reviewer interface. For example, you can rename source.department to "Business Unit" or destination.name to "Application" to better match your organization's terminology.

Overrides can be configured globally (applying to all reviews) or scoped to a specific review configuration by providing a workflow_id. Workflow-specific overrides take precedence over global overrides.

Parameters

Get Column Name Overrides

GET /api/private/workflows/access/global_settings/column_name_overrides

Get Global Overrides

Get Workflow-Scoped Overrides

Example Response

Set Column Name Overrides

PATCH /api/private/workflows/access/global_settings/column_name_overrides

Example: Set Global Overrides

Example: Set Workflow-Scoped Overrides

Response

Clear Column Name Overrides

DELETE /api/private/workflows/access/global_settings/column_name_overrides

Remove column name overrides. Optionally specify field_names to clear specific overrides, or omit to clear all overrides for the given scope.

Clear All Global Overrides

Clear Specific Overrides

Response

Use these APIs to configure for Veza Access Reviews.

The settings that can be configured by a Veza administrator are:

Use these operations to add and manage help pages for access reviewers, and customize pop-up messages when a review starts, or when rows are signed off.

Create help page

Add custom help messages for reviewers by providing the plain text template_body, name, and an existing workflow_id and usage where the template will apply. All reviews (certifications) for the configuration (workflow) will use the new template.

Template usage

The usage field determines how and when the help page will be visible to users. It must be one of the following values:

• HELP_PAGE: Reviewers can access help pages from reviewer's interface by clicking the User Guide icon. The help page will also appear when viewing the review for the first time.

• REVIEW_START: Opens when reviewers start a review.

• SIGN_OFF

Only one help page can exist at a time for a given workflow and usage. You can manage global help pages by using 00000000-0000-0000-0000-000000000000 as the workflow_id. Global help pages for each usage will apply to all reviews for all configurations.

Template formatting

The template can use markdown and placeholders, for example:

See for more information about placeholders.

Example request:

List help pages

Get all configured help page templates.

Example response:

Get help page

Returns the current help page template for an existing workflow_id and usage.

• The usage parameter must be specified. For the existing help page template, the usage value should be HELP_PAGE.

• To retrieve the tenant-wide default template (if it was set), use an all-zero UUID (00000000-0000-0000-0000-000000000000) for the workflow_id.

Example request:

Get review help page

Returns the current template for a given certification id.

Example request:

Example response:

Delete help page

Permanently remove the help page template for a workflow_id and usage. It will no longer apply to reviews for using the configuration, specified by workflow_id.

• The usage parameter must be specified. For the existing help page template, the usage value should be HELP_PAGE.

• To clear the tenant-wide default template, use an all-zero UUID for the workflow_id: 00000000-0000-0000-0000-000000000000.

Example request:

Update help page

PUT {{veza_url}}/api/preview/awf/help_page_templates

Update the help page for the specified workflow_id and usage:

• To add a tenant-wide default template, use an all-zero UUID for the workflow_id: 00000000-0000-0000-0000-000000000000.

• Updating a template now uses a plain text template_body, instead of a base64-encoded string.

Example request:

Create a new access review certification from an existing workflow.

Overview

Use dynamic_information to filter certification results to specific identities at creation time. This enables you to use a broad query at the workflow level, and then scope individual reviews to certain identities when creating the certification.

Identity IDs and types are sourced from the Veza Authorization Graph and must match existing graph node values from your integrated identity providers.

Endpoint

POST /api/preview/awf/certifications

Request Body

Dynamic Information

The dynamic_information parameter allows you to filter certification results to specific user identities at creation time.

Identity Object

Reviewer Assignment

The reviewer_assignment and reviewer_assignment_second_level objects configure how reviewers are assigned to certification rows.

Response

Examples

Basic Certification

Create a certification using the latest data:

Dynamic Filtering (Joiner/Mover/Leaver)

Use dynamic_information to scope a certification to specific identities. For mover scenarios, include previous_manager_id:

Multi-Level Review

Create a certification with multi-level approval requirements:

Identity Types

Use the graph node type that corresponds to your integrated IdP:

Identity IDs and types must match the values stored in the Veza Authorization Graph. You can find these values by querying the graph or viewing entity details in the Veza UI.

See Also

• - Get workflow IDs

• - View created certifications

• - Complete parameter reference

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be "expired" when it becomes overdue. An expired review is read-only and is not shown to reviewers.

Parameters

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

List, create, and delete saved filters, globally or for a single workflow. Reviewers can pick from available quick filters under Certification Filters > Saved Filters.

Updates webhook status and details for a certification result.

If you have configured a custom webhook to conduct automated access removal or another form of remediation, you can update Veza with the notification status.

Your application can use this endpoint to send a POST request updating the webhook state, visible to other reviewers from Veza's Certification UI.

This endpoint can also be called during the 7-day grace period after a certification completes or expires. Calls during the grace period require the admin, Access Reviews Admin, or operator role.

Configure whether due dates are required when creating or editing access reviews. When enabled, review creators must specify a due date before creating a review.

This setting can be configured globally or per-workflow. When a workflow-specific setting is applied, it overrides the global setting for reviews created from that Review Configuration.

Parameters

The setting accepts an object with boolean fields for each review level:

Examples

Enable mandatory due dates for first-level reviews only:

Enable mandatory due dates for all review levels:

Example cURL request (global setting):

Example cURL request (workflow-specific setting):

Get Mandatory Due Date Settings

Set Mandatory Due Date Settings

By default, when a review is created, a user can optionally view the status of the data sources involved in the review. This API allows the behavior to change, requiring that the data source status is shown to the user and acknowledged during review creation.

Parameters

Possible values are:

• DATASOURCE_ACKNOWLEDGEMENT_UNKNOWN = 0

• DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN = 1

• DATASOURCE_ACKNOWLEDGEMENT_REQUIRED = 2

Get Data Source Acknowledgement Setting

Set Data Source Acknowledgement Setting

An Admin or Operator user can complete a review by clicking the "Complete Review" button.

Once a review is marked as "completed," it becomes read-only and is no longer visible to reviewers. By default, a review can be completed when all rows have a signed-off decision.

This API allows you to modify this behavior, enabling a review to be completed at any time, or only when all rows are signed off with a non-rejected decision. The latter option is useful if your organization prefers to complete reviews only after all rejected access has been remediated.

Parameters

Possible values are:

• COMPLETION_ALLOWED_UNKNOWN = 0

• COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION = 1 (Review can be completed only when all result rows have a decision)

• COMPLETION_ALLOWED_ANYTIME = 2 (Review can be completed any time)

Example

Get Review Completion Settings

Set Review Completion Settings

Configure default grouping behavior for access review rows. When enabled, review rows are automatically organized by the specified column values, making it easier for reviewers to process large datasets by grouping related items together.

The setting allows admins to configure a default group by column and collapsed/expanded behavior, either globally or per-workflow.

Parameters

Configure predefined notes as menu options when reviewers approve or reject rows. This feature can be configured globally for all reviews or specifically for individual review configurations. When configured for a specific review configuration (using workflow_id), those settings override any global predefined notes.

The predefined notes appear as selectable options in the notes dialog when making decisions, suggesting standardized responses alongside free-form text entry.

Parameters