These endpoints enable listing workflows, listing certifications, getting certification results, and updating certifications. They can be used to programmatically retrieve workflow and certification details, and update certification rows with a decision or note, such as ticket number.

These endpoints also provide utility functionality, such as managing the reviewer deny list, populating results with webhook response info, and customizing quick filters, smart actions, and help pages.

• List Workflows

• List Certifications

• List Certification Results

• Update Certification Result

• Force Update Result

• Update Webhook Info

• Get Certification Result

• Manage Reviewer Deny List

• Workflow Parameters

• Quick Filters

• Help Page Templates

• Smart Action Definitions

• Delegate Reviewers

• List Reviewer Infos

APIs for Veza Access Reviews are subject to change, and as such are provided with the /preview API collection. Use the appropriate prefix when calling the API, for example, your-org.vezacloud.com/api/preview/.

Quick start

First, save your API key and Veza base URL as environment variables:

export VEZA_TOKEN=APIKEY
export VEZA_URL=https://preview.vezacloud.com

List Workflows

Get all workflows and IDs:

curl "$BASE_URL/api/preview/awf/workflows" \
  -H "authorization: Bearer $VEZA_TOKEN"

List Certifications

Use a workflow id to get active and pending certifications for that workflow:

curl "$BASE_URL/api/preview/awf/certifications?workflow_id=b9dc2586-5f30-4462-b6be-53f62debc40f" \
  -H "authorization: Bearer $VEZA_TOKEN"

The response will include certification details, including the certification ids.

List Certification Results

Using a certification id, you can get results for the certification, including entity attributes:

curl "$BASE_URL/api/preview/awf/certifications/b2562ef3-a4b3-4b30-8a45-1ba36f945d10/results?offset=0&size=30" \
  -H "authorization: Bearer $VEZA_TOKEN"

Update Certification Result

Update a certification result row with a note:

curl -X PUT "$BASE_URL/api/preview/awf/certifications/b2562ef3-a4b3-4b30-8a45-1ba36f945d10/results" \
  -H "authorization: Bearer $VEZA_TOKEN" \
  -d '{"value": {"result_id": 0,"decisions": "REJECTED", "notes": "Over-privileged"}}'

An Admin or Operator user can complete a review by clicking the "Complete Review" button.

Once a review is marked as "completed," it becomes read-only and is no longer visible to reviewers. By default, a review can be completed when all rows have a signed-off decision.

This API allows you to modify this behavior, enabling a review to be completed at any time, or only when all rows are signed off with a non-rejected decision. The latter option is useful if your organization prefers to complete reviews only after all rejected access has been remediated.

Parameters

Possible values are:

• COMPLETION_ALLOWED_UNKNOWN = 0

• COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION = 1 (Review can be completed only when all result rows have a decision)

• COMPLETION_ALLOWED_ANYTIME = 2 (Review can be completed any time)

Example

{
    "value": "COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION"
}

Get Review Completion Settings

Set Review Completion Settings

Returns all certifications for an access workflow.

Parameters

You can use to retrieve all valid workflow IDs.

Examples

Request

Response

values will contain all workflow details. The response may be paginated:

Sample response:

This page describes common properties for listing workflows, certifications, and certification results:

Workflow Properties

When , all Veza Workflows are returned within a values array. Each has the properties:

Certification Properties

returns all Certifications for a workflow, within a values array.

Note that to maintain certification integrity, some properties are immutable and can't be modified, while other values system-updated. Mutable fields such as "name," "notes," "reviewers" and "due date" can be changed by operators and admins using the Veza UI:

See for more details on query construction.

Internal fields are updated by the workflow service to store important metadata:

States can be:

• CERT_STATE_SEARCHING // The query is still running

• CERT_STATE_IN_PROGRESS // the certification is being reviewed

• CERT_STATE_COMPLETED // the review of the certification is complete

Result Properties

include a numeric ID, the query details, and any decisions and notes. Each result includes entity details for the source -> destination nodes and the cumulative permissions under review:

Valid decisions are:

1. RESULT_DECISION_NONE // No decision has been made

2. RESULT_DECISION_ACCEPTED // The access described in the result row is acceptable

3. RESULT_DECISION_REJECTED // The access described in the result row isn't correct

4. RESULT_DECISION_FIXED // The access was rejected, but has been fixed

Both the number or string value for the decision are allowed, for example "decision": 4 or "decision": RESULT_DECISION_FIXED.

The notes field will always contain the most recent note. Previous notes can be reviewed in the using the List Cert Results API.

ResultNode

Shows source, destination, or intermediate entity details for a query result:

WorkflowUser

Reviewer details, typically a Veza user account. If are configured, the user type and id refer to Veza graph entities:

You can get details for a local Veza user from Administration > User Management. For graph entities (identities from an external identity provider), inspect the entity details using Access Search or the Entities page. will return all users for a given certification.

• When assigning reviewers using preview Workflows APIs, requested users are validated before assigning them to a certification result, and not assigned when the user can’t be found. Assignee id and user_type are required to identify reviewers. name and email are optional but if provided must match the Veza user record.

ActionLog

Results contain a record of all prior actions on a certification result.

Possible actions are:

• NOTE_ADDED

• REVIEWER_ASSIGNED

• DECISION

The response will include the type, id, email, and name of the user who made the change:

ReviewerAssignmentInstructions

The reviewer_assignment specifies how reviewers should be assigned to rows, during initial certification create or when reviewers are re-assigned by smart action.

users_manager and resource_managers assigns reviewers based on Global IdP settings.

reviewers is a way to specify one or more reviewers to apply to every row. fallback_reviewers is one or more reviewers that to assign to rows if auto assign by user or resource manager fails for any reason

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be "expired" when it becomes overdue. An expired review is read-only and is not shown to reviewers.

Parameters

The value can be True or False.

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Parameters

accept_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

reject_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

approve_and_sign_off_button_behavior can be:

• HIDE_OR_SHOW_BEHAVIOR_UNKNOWN = 0

• SHOW = 1

• HIDE = 2

diff_dropdown_behavior can be:

• NORMAL = 1 (Enables all users to see decisions and access changes from previous reviews for the same configuration)

• ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE = 2 (Prevents users with the "Access Reviewer" role from accessing this option)

Example

Get Review UI Customizations

Set Review UI Customizations

Enable or disable self-review prevention. When self-review prevention is enabled, users are prevented from being assigned as reviewers for rows that relate to their own access and permissions.

Parameters

The value can be either an integer or string:

• SELF_REVIEWER_CHECKING_DISABLED = 1 (or "SELF_REVIEWER_CHECKING_DISABLED" as string)

• SELF_REVIEWER_CHECKING_ENABLED = 2 (or "SELF_REVIEWER_CHECKING_ENABLED" as string)

Examples

Example using string value:

Example using integer value:

Example cURL request:

Get Self Review Settings

Set Self Review Settings

Updates webhook status and details for a certification result.

If you have configured a custom webhook to conduct automated access removal or another form of remediation, you can update Veza with the notification status.

Your application can use this endpoint to send a POST request updating the webhook state, visible to other reviewers from Veza's Certification UI.

Path parameters

certification_id - id of the certification containing the result to update.

Body

{
  "result_id": "0",
  "notification_status": "FAILED",
  "webhook_info": "Ticket could not be created"
}

The request body must include the id of the result to update. Valid notification_status are:

• PENDING

• SUCCEED

• FAILED

Webhook_info strings can contain up to 255 bytes.

Response

A successful response will be empty {}

This setting is configurable on the Access Reviews > Settings page. Enable Reject incomplete rows to reject and sign off on undecided rows when a review expires.

This API allows you to change the behavior when a review expires (which can be enabled in Review Auto-Complete Settings). Depending on the behavior, incomplete rows can be auto-rejected when the review deadline passes.

Review expiration behavior can be configured globally, or for all reviews for a single Review Configuration, specified by workflow_id in the request.

Request Structure

The request body must include a setting object with the following structure:

{
  "workflow_id": "string",
  "setting": {
    "behavior": 0,
    "note_to_add": "string"
  }
}

Parameters

Where:

• workflow_id (string, optional): Specific review configuration ID. If omitted, applies globally to all reviews.

• setting.behavior (integer): The expiration behavior mode:

  • 0 = DO_NOTHING: No action is made on incomplete rows (default)

  • 1 = AUTO_REJECT_INCOMPLETE_RESULTS: Reject and sign-off any results that are incomplete when the review expires

• setting.note_to_add (string, optional): Note to be added when auto-rejecting incomplete results

Example

Example request:

{
  "workflow_id": "string",
  "setting": {
    "behavior": 1,
    "note_to_add": "Rejected incomplete result due to review expiration."
  }
}

Get Review Expiration Behavior

Set Review Expiration Behavior

Enable or disable the "auto-complete" feature. When auto-complete is enabled, a review will automatically be completed once all rows have a signed-off decision, or a non-rejected signed-off decision, depending on the "Completion Allowed Settings."

Parameters

Possible values are:

• AUTO_COMPLETE_UNKNOWN

• AUTO_COMPLETE_ENABLED

• AUTO_COMPLETE_DISABLED

Example

Get Review Auto-Complete Settings

Set Review Auto-Complete Settings

Configure the default order in which review rows are displayed. Note: Users can later sort the rows as they prefer.

The order is specified using a SCIM "order by" expression. The default value is source.type asc.

Valid Values

Valid values include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• idp.ATTR

Where ATTR is an attribute name such as "id" or "name".

Example

Get Review Sort Order

Set Review Sort Order

Returns a list of all workflows, including query details and creator information.

Examples

Request

curl '{{VEZA_URL}}/api/preview/awf/workflows' \
  -H 'authorization: Bearer '$token

Response

A successful response will include the Workflow details.

See Workflow Parameters for additional details on the complete workflow object.

{
    "values": [
        {
            "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
            "name": "demo",
            "description": "demo",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleWorkspaceUser",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudProject",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1690354800",
                "waypoint_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudIamRoleBinding",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "path_summary_node_types": null,
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": true,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-07-27T03:34:56.166550127Z"
        },
        {
            "workflow_id": "baecbd47-bd3d-4d52-acb8-34840a8973b2",
            "name": "Azure PS",
            "description": "",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "Principal",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureDataLakeFilesystem",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1675900800",
                "waypoint_node_types": null,
                "path_summary_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureADGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "ActiveDirectoryGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureRoleAssignment",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureAssignmentPermissions",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": false,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-02-09T03:07:24.458473708Z"
        }
    ]
}

Configure predefined notes as menu options when reviewers approve or reject rows. This feature can be configured globally for all reviews or specifically for individual review configurations. When configured for a specific review configuration (using workflow_id), those settings override any global predefined notes.

The predefined notes appear as selectable options in the notes dialog when making decisions, suggesting standardized responses alongside free-form text entry.

Parameters

The request body accepts:

• reject_notes: Array of predefined note options shown when rejecting rows

• accept_notes: Array of predefined note options shown when approving rows

• workflow_id: (Optional) Specific review configuration ID to override global settings

Example

Example request body:

{
    "value": {
        "reject_notes": [
            "Rotate now",
            "Delete secret"
        ],
        "accept_notes": []
    },
    "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"  // Optional
}

Get Predefined Notes Settings

Retrieve the current predefined notes settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Authorization: Bearer YOUR_API_KEY'

Configuration-Specific Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'

Example response:

{
    "value": {
        "reject_notes": [
            "Rotate now",
            "Delete secret"
        ],
        "accept_notes": []
    }
}

Set Predefined Notes Settings

Update the predefined notes settings globally or for a specific review configuration.

Configuration-Specific Request:

curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/predefined_decision_notes' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
    "value": {
        "reject_notes": [
            "Rotate now",
            "Delete secret"
        ],
        "accept_notes": []
    },
    "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

Parameters

The request body accepts:

• allow_csv_exports (boolean) - Enable or disable CSV export functionality for reviewers

• allow_pdf_exports (boolean) - Enable or disable PDF export functionality for reviewers

• workflow_id (optional string) - Specific review configuration ID to override global settings

Example

Example request body:

{
  "value": {
    "allow_csv_exports": true,
    "allow_pdf_exports": false
  },
  "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"  // Optional
}

Get Reviewer Export Settings

Retrieve the current reviewer export permission settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Authorization: Bearer YOUR_API_KEY'

Configuration-Specific Request:

curl -L 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports?workflow_id=8ae1c414-3a76-46cb-950a-925316b3f264' \
-H 'Authorization: Bearer YOUR_API_KEY'

Example response:

{
  "value": {
    "allow_csv_exports": false,
    "allow_pdf_exports": false
  }
}

Set Reviewer Export Settings

Update the reviewer export permission settings globally or for a specific review configuration.

Global Settings Request:

curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
  "value": {
    "allow_csv_exports": true,
    "allow_pdf_exports": false
  }
}'

Configuration-Specific Request:

curl -L -X PUT 'https://your-organization.vezacloud.com/api/private/workflows/access/global_settings/allow_reviewer_exports' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-d '{
  "value": {
    "allow_csv_exports": true,
    "allow_pdf_exports": false
  },
  "workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}'

Example response:

{}

Administrators can configure delegate reviewers for who would otherwise be assigned or auto-assigned to certification results. Specifying a delegate reviewer for another Veza user allows them to fulfill the responsibilities of that user — for example, if a manager is on leave, out-of-office, or otherwise unavailable.

• Any certification items assigned to the original reviewer are also assigned to the delegated reviewer.

• Delegate reviewers are notified of the assignment and receive notifications in place of the original reviewer. They can review and sign-off on any results assigned to the original reviewer.

• The original reviewer can still act on results, but will not receive assignment or reminder emails.

Examples

Add user delegations

The JSON payload contain pairs of original and delegate . You can use to get all the required details for reviewers assigned to a certification.

Add delegation for Veza system users:

A successful response will be empty.

You can map both local Veza users and identities from an .

Add delegation for Okta users (with IdP settings configured):

Note that this assumes the IdP setting are configured to use "idp_unique_id" to correlate identities, as in the Okta example .

List user delegations

A successful response will list all configured delegations, contained in a values array:

Remove user delegations

To remove delegations, post the configuration to /api/preview/awf/delegation/users:remove.

A successful response will be empty.

Returns information about all users assigned to a certification and its results. This will include the users' email and ID, along with their progress on the certification (row_stats listing actions counts by type).

Parameters

Examples

Request

Response

A successful response returns AccessReviewerInfo objects within a values array:

List, create, and delete saved filters, globally or for a single workflow. Reviewers can pick from available quick filters under Certification Filters > Saved Filters.

Requests require a for authentication.

Examples

Add a quick filter

Add a quick filter by specifying an optional workflow_id and a single source or destination node property, corresponding to a Review interface column.

Filters can also apply to abstract_permissions or concrete_permissions (see example response).

Valid filter operators are:

• co "contains"

• eq "equals"

• ne "not equals"

• sw "starts with"

• ew "ends with"

With a workflow_id specified, the filter will only apply to certifications on that workflow. Otherwise, reviewers can apply the quick filter to any certification:

A successful response will contain the filter id, for example:

List all quick filters

Including a workflow_id in the query returns quick filters with a matching workflow_id and quick filters with no workflow_id:

Example response:

Remove quick filter by quick filter id

Use these APIs to configure for Veza Access Reviews.

The settings that can be configured by a Veza administrator are:

• : Automatically complete reviews once all rows have a signed-off decision, or a non-rejected signed-off decision.

• : Enable review completion at any time, or only when all rows are signed off with a non-rejected decision.

• : Require review creators to view and acknowledge the data source status shown at review creation.

• : Enable or disable expiration of overdue reviews.

• : Reject and sign off incomplete rows when a review expires.

• : Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.

• : Configure default columns which reviewers will see when they open a review.

• : Set whether notes are required when approving or rejecting access.

• : Set the default sort order and sorting column when opening a review.

• : Add suggested notes as menu options when reviewers approve or reject rows.

• : Configure default grouping behavior for review rows to organize data by column values.

• : Configure outlier detection to identify anomalous access patterns by comparing users to peer groups (Early Access, API-only).

• : Control whether reviewers can export review data to CSV or PDF formats.

For each endpoint, a GET request returns the current setting, and a PUT request updates the setting. Use your unique Veza URL and API key (see ) in your request, for example:

Postman Collection

Use the Postman collection as an alternative to cURL commands for testing and configuring Veza Access Reviews global settings:

Import Instructions

To import the collection into Postman:

Configure Variables

Before using the collection, configure these required variables on the Variables tab:

The collection uses Bearer token authentication. Your apiToken variable automatically populates the Authorization header for all requests.

ForceUpdateAwfResults allows administrators to modify results more than normally allowed, such as changing sign-off status, or changing a row's decision after a certification expires.

The API token used for this request must be created for a user with the role.

A forced update request:

• Can undo sign-off of a row.

• On an expired or completed certification, during the grace period, rows can be modified as normal (Assuming they're no longer signed off).

  • The grace period for changes is 7 days after certification completion or expiration

A :

• Can't undo sign-off of a row.

• On an expired certification, during the grace period, a rejected row can be marked as fixed by admin/operator.

Parameters

Sample Request

Sample Response

A successful response will be empty:

By default, when a review is created, a user can optionally view the status of the data sources involved in the review. This API allows the behavior to change, requiring that the data source status is shown to the user and acknowledged during review creation.

Parameters

Possible values are:

• DATASOURCE_ACKNOWLEDGEMENT_UNKNOWN = 0

• DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN = 1

• DATASOURCE_ACKNOWLEDGEMENT_REQUIRED = 2

Get Data Source Acknowledgement Setting

Set Data Source Acknowledgement Setting

Returns Access Graph relationships for a certification result, including intermediate role details and accumulated permissions.

Parameters

Omit snapshot_id to get the most recent access graph. Specify the snapshot_id of the original certification to show relationships at the time of certification.

Examples

Request

curl 'https://{{VezaURL}}/api/preview/awf/access_graph' \
-H 'authorization: Bearer '$TOKEN \
-G -d 'certification_id=abe5c346-84ad-49b0-bafc-614a8365c883' \
-d 'result_id=1'

Response

The out_edges of each node will contain the IDs of other directly connected nodes. For example, if "OktaUser" is connected to two "OktaGroup" nodes G1 and G2, the user's out-edges will be [{G1}, {G2}]. The node id for each connected node will be included in the response, as well as the status of the relevant data sources, for example:

{
  "nodes": [
    {
      "properties": {
        "id": "arn:aws:iam::973979857296:role/FederatedS3",
        "name": "FederatedS3",
        "type": "AwsIamRole"
      },
      "out_edges": [
        {
          "destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509"
        }
      ]
    },
    {
      "properties": {
        "id": "0bba9374-d4f5-4c77-93d2-7dfde581fa8a",
        "name": "Abel_Maclead",
        "type": "AzureADUser"
      },
      "out_edges": [
        {
          "destination_node_id": "arn:aws:iam::973979857296:role/FederatedS3"
        }
      ]
    },
    {
      "properties": {
        "id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::877042069677/S3Bucket/2ce2cbf45bcc5d748c800358d9932a251d670509",
        "name": "Read",
        "type": "AwsIamEffectivePermission"
      },
      "out_edges": [
        {
          "destination_node_id": "arn:aws:s3:::cct-cct02-finance"
        }
      ]
    },
    {
      "properties": {
        "id": "arn:aws:s3:::cct-cct02-finance",
        "name": "cct-cct02-finance",
        "type": "S3Bucket"
      },
      "out_edges": []
    }
  ],
  "accumulated_effective_permissions": [
    "Read"
  ],
  "accumulated_raw_permissions": [
    "s3:GetObject"
  ],
  "datasource_infos": [
        {
            "datasource_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef",
            "external_id": "160e97cf-4b8a-4841-800b-49f8d6fa17ef",
            "name": "",
            "last_sync_time": "2022-09-12T22:15:34.874682421Z",
            "agent_type": "",
            "has_error": false,
            "is_deleted": false,
            "reason": "",
            "last_error_message": "",
            "has_warning": false
        },
        {
            "datasource_id": "",
            "external_id": "",
            "name": "",
            "last_sync_time": "2022-09-12T22:09:47.245436023Z",
            "agent_type": "",
            "has_error": false,
            "is_deleted": false,
            "reason": "",
            "last_error_message": "",
            "has_warning": false
        }
  ]
}

Apply a decision, note, sign-off, or reviewer change to a numbered certification result.

Each row of the certification results can be annotated, marked as ACCEPTED, or REJECTED, signed-off, or assigned to a different reviewer.

Parameters

value must include the result_id and any mutable fields to update:

Valid decisions are:

• NONE // No decision has been made

• ACCEPTED // The access described in the result row is acceptable

• REJECTED // The access described in the result row isn't correct

• FIXED // The access was rejected but has been fixed

Adding a note overwrites the previous value. Historical notes are included in the action log when Listing Certification Results. When viewing the row in the UI, only the most recent note is shown.

Re-assigning reviewers

A result’s reviewer can be reassigned by updating the reviewers field with a list of one or more Access Workflow User objects:

curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
 --data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "CustomIDPUser", "id": "125", "email": "[email protected]", "name": "Valid Reviewer"}]}}'

Note that all fields are required when assigning a reviewer. As of the current release, there is no customer-facing API to get local user ids. For this reason, API-based reviewer reassignment is recommended only when a graph IdP is configured as the Global Workflows IdP, and you can programmatically retrieve required identifiers such as user "name," "id," and "email."

Examples

Reject with note

curl -X PUT '{{baseurl}}/api/preview/awf/certifications/f9123002-f056-491f-978f-f203bc9885ed/results' \
  -H 'authorization: Bearer '$token \
  --data-raw '{
  "value": {
    "result_id": 0,
    "decision": "REJECTED",
    "notes": "Over-privileged"
  }
}'

Change the reviewer to a Custom IdP user

curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
 --data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "CustomIDPUser", "id": "125", "email": "[email protected]", "name": "Valid Reviewer"}]}}'

Assign a local user as a reviewer

curl -X PUT '{{baseurl}}/api/preview/awf/certifications/{{cert_id}}/results' \
-H 'authorization: Bearer ' $TOKEN \
--data-raw '{"value": {"result_id": 0,"reviewers": [{"user_type": "localCookieUser", "id": "0ffcfbc7-6339-4aed-afa4-ff3bea505485", "email": "[email protected]", "name": "demo-auth0"}]}}'

Response

A successful response will be empty: {}.

This API configures the default columns which reviewers will see when they open a review, as well as columns that should be hidden from reviewers but visible to administrators. If workflow_id is specified then the configuration will only be applied to reviews related to the particular Review Configuration identified by workflow_id.

The request body includes two main fields:

• default_ordered_columns: Array of column names that will be visible to all users (reviewers, administrators, and operators)

• hide_from_reviewers_columns: Array of column names that will be hidden from users with the reviewer role but remain visible to administrators and operators

Validation Rules

Important validation rules:

• Column names cannot appear in both default_ordered_columns and hide_from_reviewers_columns simultaneously

• Column names cannot be empty strings

• Column names cannot contain spaces or commas

• The system validates these constraints and returns an error if violations are found

Valid Column Values

The valid values to show entity attributes include:

• source.ATTR

• destination.ATTR

• waypoint.ATTR

• path_summary.ATTR

• idp.ATTR

Where ATTR is an attribute name such as "id" or "name".

The following column values are also valid:

• status

• abstract_permissions

• concrete_permissions

• updated_at

• notes

• reviewers

• decision

• decision_by

• decision_by_id

• decision_by_name

• decision_by_email

• decision_at

• marked_fixed_by_id

• marked_fixed_by_name

• marked_fixed_by_email

• marked_fixed_at

• signed_off_state

• signed_off_by_id

• signed_off_by_name

• signed_off_by_email

• signed_off_at

• notification_status

• automation_run_ids

• no_decision_or_decision_by

• Is_signed_off

Example

{
  "value": {
    "default_ordered_columns": [
      "source.name",
      "source.department",
      "source.customprop_worker_status",
      "source.tags",
      "path_summary.name",
      "concrete_permissions",
      "destination.name",
      "destination.customprop_display_name",
      "reviewers"
    ],
    "hide_from_reviewers_columns": [
      "source.identity_unique_id",
      "idp.on_premises_distinguished_name"
    ]
  },
  "workflow_id": "002063d2-7898-4183-b5fb-1192758fdec7"
}

This example configuration shows sensitive identity information (unique IDs and distinguished names) to administrators while hiding them from reviewers, allowing for better security and privacy control in access reviews.

Get Review Column Defaults

Set Review Column Defaults

List All Column Settings

Define filter-based actions that reviewers can apply to certifications results with a matching attribute or status.

Reviewers can view and apply custom actions from the Review interface by clicking Smart Action > Prepared Actions.

Add smart action definition

Create a smart action definition, globally or for a single Workflow.

A certification includes all source and destination node properties discovered or added by Veza. You can specify a SCIM filter to select the results to affect, for example:

Example request:

The filter can apply to any source or destination node property.

When apply_to_all_rows is true and no other filter criteria is specified, the action will run on all certification results.

Mutable fields and mutable filters

Mutable fields contain result attributes that are not sourced from Access Graph metadata. Use mutable_fields to apply changes to a result, and mutable_filter to filter results based on decision or sign-off state:

Remove a smart action definition

Delete a prepared action by definition id.

List smart action definitions

Returns an array of smart action definitions. By default, this endpoint lists all definitions. If a workflow_id is specified, only definitions for that workflow are included in the response.

Update a smart action definition

Alter a smart action definition by specifying the id and an array of values to change.