1 of 33

Access Reviews APIs

Methods for interacting with workflows and certifications

These endpoints enable listing workflows, listing certifications, getting certification results, and updating certifications. They can be used to programmatically retrieve workflow and certification details, and update certification rows with a decision or note, such as ticket number.

These endpoints also provide utility functionality, such as managing the reviewer deny list, populating results with webhook response info, and customizing quick filters, smart actions, and help pages.

Core Workflow Operations

APIs for Veza Access Reviews are subject to change, and as such are provided with the /preview API collection. Use the appropriate prefix when calling the API, for example, your-org.vezacloud.com/api/preview/.

Quick start

First, save your and Veza base URL as environment variables:

Get all workflows and IDs:

Use a workflow id to get active and pending certifications for that workflow:

The response will include certification details, including the certification ids.

Using a certification id, you can get results for the certification, including entity attributes:

Update a certification result row with a note:

Workflow Parameters Reference

Workflows, certifications, and result details

This page describes common properties for listing workflows, certifications, and certification results:

Workflow Properties

When , all Veza Workflows are returned within a values array. Each has the properties:

List Workflows

Get all workflows and certification status

Returns a list of all workflows, including query details and creator information.

Method

syntax

GET

{{base_url}}/api/preview/awf/workflows

Examples

Request

Response

A successful response will include the Workflow details.

See for additional details on the complete workflow object.

List Certifications

Get pending and completed certifications for a workflow

Returns all certifications for an access workflow.

Method

syntax

Parameters

Name

type

Update Certification Result

Add decisions and notes to a certification result

Apply a decision, note, sign-off, or reviewer change to a numbered certification result.

Each row of the certification results can be annotated, marked as ACCEPTED, or REJECTED, signed-off, or assigned to a different reviewer.

Method

syntax

PUT

{{base_url}}/api/preview/awf/certifications/{certification_id}/results

Parameters

Name

Type

Description

value must include the result_id and any mutable fields to update:

Name

Type

Req.

Description

Valid decisions are:

NONE // No decision has been made
ACCEPTED // The access described in the result row is acceptable
REJECTED

Adding a note overwrites the previous value. Historical notes are included in the action log when . When viewing the row in the UI, only the most recent note is shown.

Re-assigning `reviewers`

A result’s reviewer can be reassigned by updating the reviewers field with a list of one or more Access Workflow User objects:

Name

Type

Req.

Description

Note that all fields are required when assigning a reviewer. As of the current release, there is no customer-facing API to get local user ids. For this reason, API-based reviewer reassignment is recommended only when a graph IdP is configured as the , and you can programmatically retrieve required identifiers such as user "name," "id," and "email."

Examples

Reject with note

Change the reviewer to a Custom IdP user

Assign a local user as a reviewer

Response

A successful response will be empty: {}.

Access Reviews APIs

Methods for interacting with workflows and certifications

Core Workflow Operations

APIs for Veza Access Reviews are subject to change, and as such are provided with the /preview API collection. Use the appropriate prefix when calling the API, for example, your-org.vezacloud.com/api/preview/.

Quick start

First, save your and Veza base URL as environment variables:

Get all workflows and IDs:

Use a workflow id to get active and pending certifications for that workflow:

The response will include certification details, including the certification ids.

Using a certification id, you can get results for the certification, including entity attributes:

Update a certification result row with a note:

{
    "values": [
        {
            "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
            "name": "demo",
            "description": "demo",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleWorkspaceUser",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudProject",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1690354800",
                "waypoint_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudIamRoleBinding",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "path_summary_node_types": null,
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": true,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-07-27T03:34:56.166550127Z"
        },
        {
            "workflow_id": "baecbd47-bd3d-4d52-acb8-34840a8973b2",
            "name": "Azure PS",
            "description": "",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "Principal",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureDataLakeFilesystem",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1675900800",
                "waypoint_node_types": null,
                "path_summary_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureADGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "ActiveDirectoryGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureRoleAssignment",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureAssignmentPermissions",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": false,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-02-09T03:07:24.458473708Z"
        }
    ]
}

{
    "values": [
        {
            "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
            "name": "demo",
            "description": "demo",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleWorkspaceUser",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudProject",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1690354800",
                "waypoint_node_types": {
                    "nodes": [
                        {
                            "node_type": "GoogleCloudIamRoleBinding",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "path_summary_node_types": null,
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": true,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-07-27T03:34:56.166550127Z"
        },
        {
            "workflow_id": "baecbd47-bd3d-4d52-acb8-34840a8973b2",
            "name": "Azure PS",
            "description": "",
            "owner": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "notes": "",
            "query": {
                "raw_permissions": null,
                "effective_permissions": null,
                "source_node_types": {
                    "nodes": [
                        {
                            "node_type": "Principal",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "required_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "avoided_intermediate_node_types": {
                    "nodes": [],
                    "nodes_operator": "AND"
                },
                "destination_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureDataLakeFilesystem",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "no_relation": false,
                "snapshot_id": "1675900800",
                "waypoint_node_types": null,
                "path_summary_node_types": {
                    "nodes": [
                        {
                            "node_type": "AzureADGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "ActiveDirectoryGroup",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureRoleAssignment",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        },
                        {
                            "node_type": "AzureAssignmentPermissions",
                            "tags": [],
                            "conditions": [],
                            "condition_expression": null,
                            "node_id": "",
                            "excluded_tags": [],
                            "count_conditions": [],
                            "direct_relationship_only": false,
                            "node_type_grouping_constraint": null
                        }
                    ],
                    "nodes_operator": "AND"
                },
                "node_relationship_type": "CONFIGURED",
                "include_all_source_tags_in_results": false,
                "include_all_destination_tags_in_results": false,
                "page_size": "0",
                "page_token": ""
            },
            "creator": {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "earlypreview-auth0"
            },
            "created_at": "2023-02-09T03:07:24.458473708Z"
        }
    ]
}

{
  "values": [
      {
          "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
          "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
          "query_used": {
              "raw_permissions": null,
              "effective_permissions": null,
              "source_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleWorkspaceUser",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "required_intermediate_node_types": {
                  "nodes": [],
                  "nodes_operator": "AND"
              },
              "avoided_intermediate_node_types": {
                  "nodes": [],
                  "nodes_operator": "AND"
              },
              "destination_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleCloudProject",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "no_relation": false,
              "snapshot_id": "1690354800",
              "waypoint_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleCloudIamRoleBinding",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "path_summary_node_types": null,
              "node_relationship_type": "CONFIGURED",
              "include_all_source_tags_in_results": true,
              "include_all_destination_tags_in_results": false,
              "page_size": "0",
              "page_token": ""
          },
          "name": "demo",
          "notes": "",
          "due_date": "2023-07-30T03:44:00Z",
          "reviewers": [],
          "state": "IN_PROGRESS",
          "snapshot_time": "2023-07-26T07:00:00Z",
          "started_at": "2023-07-27T03:44:27.260812616Z",
          "query_completed_at": "2023-07-27T03:44:31.410373279Z",
          "completed_at": null,
          "created_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "completed_by": null,
          "results_updated_at": "2023-07-27T03:44:31.410373665Z",
          "results_updated_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "updated_at": "2023-07-27T03:44:31.410413829Z",
          "updated_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "error_reason": "",
          "expired_at": null,
          "version": 1,
          "total_result_count": 2433,
          "total_complete_count": 0,
          "total_rejected_count": 0,
          "total_accepted_count": 0,
          "total_fixed_count": 0
      }
  ]
}

Update Certification Result

Add decisions and notes to a certification result

Apply a decision, note, sign-off, or reviewer change to a numbered certification result.

Each row of the certification results can be annotated, marked as ACCEPTED, or REJECTED, signed-off, or assigned to a different reviewer.

Method

syntax

PUT

{{base_url}}/api/preview/awf/certifications/{certification_id}/results

Parameters

Name

Type

Description

value must include the result_id and any mutable fields to update:

Name

Type

Req.

Description

Valid decisions are:

NONE // No decision has been made
ACCEPTED // The access described in the result row is acceptable
REJECTED

Adding a note overwrites the previous value. Historical notes are included in the action log when . When viewing the row in the UI, only the most recent note is shown.

Re-assigning `reviewers`

A result’s reviewer can be reassigned by updating the reviewers field with a list of one or more Access Workflow User objects:

Name

Type

Req.

Description

Examples

Reject with note

Change the reviewer to a Custom IdP user

Assign a local user as a reviewer

Response

A successful response will be empty: {}.

{
  "values": [
      {
          "certification_id": "b2562ef3-a4b3-4b30-8a45-1ba36f945d10",
          "workflow_id": "b9dc2586-5f30-4462-b6be-53f62debc40f",
          "query_used": {
              "raw_permissions": null,
              "effective_permissions": null,
              "source_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleWorkspaceUser",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "required_intermediate_node_types": {
                  "nodes": [],
                  "nodes_operator": "AND"
              },
              "avoided_intermediate_node_types": {
                  "nodes": [],
                  "nodes_operator": "AND"
              },
              "destination_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleCloudProject",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "no_relation": false,
              "snapshot_id": "1690354800",
              "waypoint_node_types": {
                  "nodes": [
                      {
                          "node_type": "GoogleCloudIamRoleBinding",
                          "tags": [],
                          "conditions": [],
                          "condition_expression": null,
                          "node_id": "",
                          "excluded_tags": [],
                          "count_conditions": [],
                          "direct_relationship_only": false,
                          "node_type_grouping_constraint": null
                      }
                  ],
                  "nodes_operator": "AND"
              },
              "path_summary_node_types": null,
              "node_relationship_type": "CONFIGURED",
              "include_all_source_tags_in_results": true,
              "include_all_destination_tags_in_results": false,
              "page_size": "0",
              "page_token": ""
          },
          "name": "demo",
          "notes": "",
          "due_date": "2023-07-30T03:44:00Z",
          "reviewers": [],
          "state": "IN_PROGRESS",
          "snapshot_time": "2023-07-26T07:00:00Z",
          "started_at": "2023-07-27T03:44:27.260812616Z",
          "query_completed_at": "2023-07-27T03:44:31.410373279Z",
          "completed_at": null,
          "created_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "completed_by": null,
          "results_updated_at": "2023-07-27T03:44:31.410373665Z",
          "results_updated_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "updated_at": "2023-07-27T03:44:31.410413829Z",
          "updated_by": {
              "user_type": "localCookieUser",
              "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
              "email": "[email protected]",
              "name": "earlypreview-auth0"
          },
          "error_reason": "",
          "expired_at": null,
          "version": 1,
          "total_result_count": 2433,
          "total_complete_count": 0,
          "total_rejected_count": 0,
          "total_accepted_count": 0,
          "total_fixed_count": 0
      }
  ]
}

Quick Filters

Customizing saved filters for certification reviewers.

List, create, and delete saved filters, globally or for a single workflow. Reviewers can pick from available quick filters under Certification Filters > Saved Filters.

Method

Syntax

GET, POST, DELETE

{Veza URL}/api/preview/awf/quick_filters

Requests require a Veza API key for authentication.

Examples

Add a quick filter

Add a quick filter by specifying an optional workflow_id and a single source or destination node property, corresponding to a Review interface column.

Filters can also apply to abstract_permissions or concrete_permissions (see example response).

Valid filter operators are:

co "contains"
eq "equals"
ne "not equals"

With a workflow_id specified, the filter will only apply to certifications on that workflow. Otherwise, reviewers can apply the quick filter to any certification:

A successful response will contain the filter id, for example:

List all quick filters

Including a workflow_id in the query returns quick filters with a matching workflow_id and quick filters with no workflow_id:

Example response:

Remove quick filter by quick filter id

{
    "values": [
        {
            "result_id": 0,
            "source": {
                "aliases": [],
                "created_at": "2023-05-03T14:25:43Z",
                "datasource_id": "datasource:google_cloud_workspace",
                "email_addresses": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "full_admin": false,
                "google_cloud_organization_name": "organizations/123456789012",
                "guest": false,
                "id": "datasource:112655590859538682841",
                "idp_unique_id": "[email protected]",
                "is_active": true,
                "last_login_at": "2023-05-10T15:25:04Z",
                "location_areas": [],
                "mfa_enabled": false,
                "name": "[email protected]",
                "organization_names": [],
                "provider_id": "datasource",
                "suspended": false,
                "type": "GoogleWorkspaceUser"
            },
            "destination": {
                "created_at": "2021-11-01T14:23:35Z",
                "datasource_id": "datasource:google_cloud_iam",
                "google_cloud_organization_name": "organizations/123456789012",
                "id": "projects/743979515322",
                "name": "Dev GCP Project",
                "parent_id": "organizations/123456789012",
                "project_id": "striped-graph-330814",
                "provider_id": "datasource",
                "type": "GoogleCloudProject",
                "updated_at": "2022-04-07T22:08:48Z"
            },
            "accumulated_effective_permissions": [],
            "accumulated_raw_permissions": [
                "bigquery.datasets.get",
                "bigquery.datasets.getIamPolicy",
                "bigquery.tables.get",
                "bigquery.tables.getIamPolicy",
                "bigquery.tables.list",
                "iam.roles.get",
                "iam.roles.list",
                "iam.serviceAccounts.create",
                "iam.serviceAccounts.list",
                "resourcemanager.folders.create",
                "resourcemanager.folders.delete",
                "resourcemanager.folders.get",
                "resourcemanager.folders.getIamPolicy",
                "resourcemanager.folders.list",
                "resourcemanager.folders.move",
                "resourcemanager.folders.setIamPolicy",
                "resourcemanager.folders.undelete",
                "resourcemanager.organizations.get",
                "resourcemanager.organizations.getIamPolicy",
                "resourcemanager.organizations.setIamPolicy",
                "resourcemanager.projects.create",
                "resourcemanager.projects.delete",
                "resourcemanager.projects.get",
                "resourcemanager.projects.getIamPolicy",
                "resourcemanager.projects.list",
                "resourcemanager.projects.move",
                "resourcemanager.projects.setIamPolicy",
                "resourcemanager.projects.update",
                "storage.buckets.create",
                "storage.buckets.createTagBinding",
                "storage.buckets.delete",
                "storage.buckets.deleteTagBinding",
                "storage.buckets.get",
                "storage.buckets.getIamPolicy",
                "storage.buckets.list",
                "storage.buckets.listTagBindings",
                "storage.buckets.setIamPolicy",
                "storage.buckets.update"
            ],
            "updated_at": null,
            "updated_by": null,
            "signed_off_at": null,
            "signed_off_by": null,
            "notification_response_infos": [],
            "notification_status": "UNKNOWN",
            "waypoint": {
                "id": "organizations/123456789012_policy_role_binding0",
                "name": "CookieAIDevServicePrincipalRole",
                "type": "GoogleCloudIamRoleBinding"
            },
            "action_log_entries": [],
            "decision": "NONE",
            "notes": "",
            "reviewers": [
                {
                    "user_type": "localCookieUser",
                    "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                    "email": "[email protected]",
                    "name": "External User"
                }
            ],
            "signed_off_state": "NOT_SIGNED_OFF",
            "reviewer_assignment": null
        },
        {
            "result_id": 1,
            "source": {
                "aliases": [],
                "created_at": "2023-05-03T14:25:43Z",
                "datasource_id": "datasource:google_cloud_workspace",
                "email_addresses": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "full_admin": false,
                "google_cloud_organization_name": "organizations/123456789012",
                "guest": false,
                "id": "datasource:112655590859538682841",
                "idp_unique_id": "[email protected]",
                "is_active": true,
                "last_login_at": "2023-05-10T15:25:04Z",
                "location_areas": [],
                "mfa_enabled": false,
                "name": "[email protected]",
                "organization_names": [],
                "provider_id": "datasource",
                "suspended": false,
                "type": "GoogleWorkspaceUser"
            },
            "destination": {
                "created_at": "2021-11-01T14:23:35Z",
                "datasource_id": "datasource:google_cloud_iam",
                "google_cloud_organization_name": "organizations/123456789012",
                "id": "projects/743979515322",
                "name": "Dev GCP Project",
                "parent_id": "organizations/123456789012",
                "project_id": "striped-graph-330814",
                "provider_id": "datasource",
                "type": "GoogleCloudProject",
                "updated_at": "2022-04-07T22:08:48Z"
            },
            "accumulated_effective_permissions": [],
            "accumulated_raw_permissions": [
                "cloudkms.cryptoKeyVersions.create",
                "cloudkms.cryptoKeyVersions.destroy",
                "cloudkms.cryptoKeyVersions.get",
                "cloudkms.cryptoKeyVersions.list",
                "cloudkms.cryptoKeyVersions.restore",
                "cloudkms.cryptoKeyVersions.update",
                "cloudkms.cryptoKeyVersions.useToDecryptViaDelegation",
                "cloudkms.cryptoKeyVersions.useToEncryptViaDelegation",
                "cloudkms.cryptoKeys.create",
                "cloudkms.cryptoKeys.get",
                "cloudkms.cryptoKeys.getIamPolicy",
                "cloudkms.cryptoKeys.list",
                "cloudkms.cryptoKeys.setIamPolicy",
                "cloudkms.cryptoKeys.update",
                "cloudkms.keyRings.create",
                "cloudkms.keyRings.createTagBinding",
                "cloudkms.keyRings.deleteTagBinding",
                "cloudkms.keyRings.get",
                "cloudkms.keyRings.getIamPolicy",
                "cloudkms.keyRings.list",
                "cloudkms.keyRings.listTagBindings",
                "cloudkms.keyRings.setIamPolicy",
                "cloudkms.locations.get",
                "cloudkms.locations.list",
                "resourcemanager.projects.get"
            ],
            "updated_at": null,
            "updated_by": null,
            "signed_off_at": null,
            "signed_off_by": null,
            "notification_response_infos": [],
            "notification_status": "UNKNOWN",
            "waypoint": {
                "id": "organizations/123456789012_policy_role_binding11",
                "name": "cloudkms.admin",
                "type": "GoogleCloudIamRoleBinding"
            },
            "action_log_entries": [],
            "decision": "NONE",
            "notes": "",
            "reviewers": [
                {
                    "user_type": "localCookieUser",
                    "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                    "email": "[email protected]",
                    "name": "External User"
                }
            ],
            "signed_off_state": "NOT_SIGNED_OFF",
            "reviewer_assignment": null
        }
    ],
    "next_page_token": "EAI=",
    "has_more": true,
    "has_previous": false
}

Delegate Reviewers

Configure delegate Veza users who will be assigned as certification reviewers whenever a specified user would have been assigned.

Method

Operation

syntax

GET

List User Delegations

/api/preview/awf/delegation/users

POST

Add User Delegations

/api/preview/awf/delegation/users:add

POST

Remove User Delegations

/api/preview/awf/delegation/users:remove

Administrators can configure delegate reviewers for who would otherwise be assigned or auto-assigned to certification results. Specifying a delegate reviewer for another Veza user allows them to fulfill the responsibilities of that user — for example, if a manager is on leave, out-of-office, or otherwise unavailable.

Any certification items assigned to the original reviewer are also assigned to the delegated reviewer.
Delegate reviewers are notified of the assignment and receive notifications in place of the original reviewer. They can review and sign-off on any results assigned to the original reviewer.
The original reviewer can still act on results, but will not receive assignment or reminder emails.

Examples

Add user delegations

The JSON payload contain pairs of original and delegate . You can use to get all the required details for reviewers assigned to a certification.

Add delegation for Veza system users:

A successful response will be empty.

You can map both local Veza users and identities from an .

Add delegation for Okta users (with IdP settings configured):

Note that this assumes the IdP setting are configured to use "idp_unique_id" to correlate identities, as in the Okta example .

List user delegations

A successful response will list all configured delegations, contained in a values array:

Remove user delegations

To remove delegations, post the configuration to /api/preview/awf/delegation/users:remove.

A successful response will be empty.

Reviewer Export Settings

Control export permissions for reviewers.

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

Parameters

The request body accepts:

allow_csv_exports (boolean) - Enable or disable CSV export functionality for reviewers
allow_pdf_exports (boolean) - Enable or disable PDF export functionality for reviewers
workflow_id (optional string) - Specific review configuration ID to override global settings

Example

Example request body:

Get Reviewer Export Settings

Retrieve the current reviewer export permission settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Set Reviewer Export Settings

Update the reviewer export permission settings globally or for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

{
    "value": {
        "result_id": 0,
        "source": {
            "aliases": [],
            "created_at": "2023-05-03T14:25:43Z",
            "datasource_id": "datasource:google_cloud_workspace",
            "email_addresses": [
                "[email protected]",
                "[email protected]",
                "[email protected]"
            ],
            "full_admin": false,
            "google_cloud_organization_name": "organizations/123456789012",
            "guest": false,
            "id": "datasource:112655590859538682841",
            "idp_unique_id": "[email protected]",
            "is_active": true,
            "last_login_at": "2023-05-10T15:25:04Z",
            "location_areas": [],
            "mfa_enabled": false,
            "name": "[email protected]",
            "organization_names": [],
            "provider_id": "datasource",
            "suspended": false,
            "type": "GoogleWorkspaceUser"
        },
        "destination": {
            "created_at": "2021-11-01T14:23:35Z",
            "datasource_id": "datasource:google_cloud_iam",
            "google_cloud_organization_name": "organizations/123456789012",
            "id": "projects/743979515322",
            "name": "Dev GCP Project",
            "parent_id": "organizations/123456789012",
            "project_id": "striped-graph-330814",
            "provider_id": "datasource",
            "type": "GoogleCloudProject",
            "updated_at": "2022-04-07T22:08:48Z"
        },
        "accumulated_effective_permissions": [],
        "accumulated_raw_permissions": [
            "bigquery.datasets.get",
            "bigquery.datasets.getIamPolicy",
            "bigquery.tables.get",
            "bigquery.tables.getIamPolicy",
            "bigquery.tables.list",
            "iam.roles.get",
            "iam.roles.list",
            "iam.serviceAccounts.create",
            "iam.serviceAccounts.list",
            "resourcemanager.folders.create",
            "resourcemanager.folders.delete",
            "resourcemanager.folders.get",
            "resourcemanager.folders.getIamPolicy",
            "resourcemanager.folders.list",
            "resourcemanager.folders.move",
            "resourcemanager.folders.setIamPolicy",
            "resourcemanager.folders.undelete",
            "resourcemanager.organizations.get",
            "resourcemanager.organizations.getIamPolicy",
            "resourcemanager.organizations.setIamPolicy",
            "resourcemanager.projects.create",
            "resourcemanager.projects.delete",
            "resourcemanager.projects.get",
            "resourcemanager.projects.getIamPolicy",
            "resourcemanager.projects.list",
            "resourcemanager.projects.move",
            "resourcemanager.projects.setIamPolicy",
            "resourcemanager.projects.update",
            "storage.buckets.create",
            "storage.buckets.createTagBinding",
            "storage.buckets.delete",
            "storage.buckets.deleteTagBinding",
            "storage.buckets.get",
            "storage.buckets.getIamPolicy",
            "storage.buckets.list",
            "storage.buckets.listTagBindings",
            "storage.buckets.setIamPolicy",
            "storage.buckets.update"
        ],
        "updated_at": null,
        "updated_by": null,
        "signed_off_at": null,
        "signed_off_by": null,
        "notification_response_infos": [],
        "notification_status": "UNKNOWN",
        "waypoint": {
            "id": "organizations/123456789012_policy_role_binding0",
            "name": "CookieAIDevServicePrincipalRole",
            "type": "GoogleCloudIamRoleBinding"
        },
        "action_log_entries": [],
        "decision": "NONE",
        "notes": "",
        "reviewers": [
            {
                "user_type": "localCookieUser",
                "id": "e3ac5e6a-1946-4688-82a7-8a607133a1c8",
                "email": "[email protected]",
                "name": "External User"
            }
        ],
        "signed_off_state": "NOT_SIGNED_OFF",
        "reviewer_assignment": null
    }
}

Access Review Exports

Programmatic creation and download of access review exports

The Access Review Export API enables you to programmatically create, monitor, and download exports of access review results in CSV or XLSX format. These endpoints provide the same export functionality available in the Veza UI, allowing you to automate report generation and integrate review data into external systems.

Endpoints

Create Access Review Export - Initiate a new export job
- Check export status and metadata
- Download the completed export file

Workflow

Create an export job with certification ID and format
Poll the status endpoint until FINISHED
Download the export file

Create Access Review Export

Create a new export job for an access review certification.

Request

POST /api/preview/awf/exports/access_review:create

Request Body

Field

Type

Required

Description

Supported Formats: Only CSV (format 0) and XLSX (format 6) are supported for access review exports.

Response

Examples

Create a CSV export:

Create a filtered CSV export (rejected rows only):

Create an XLSX diff export:

Get Access Review Export

Retrieve the status and metadata for an export job.

Request

GET /api/preview/awf/exports/access_review/{export_id}

Path Parameters

Parameter

Type

Required

Description

Response

Export Status Values

Status

Description

Poll the export status endpoint periodically until the status is FINISHED before attempting to download. Large exports may take several minutes to complete.

Example

Download Access Review Export

Download the completed export file.

Request

GET /api/preview/awf/exports/access_review/{export_id}:download

Path Parameters

Parameter

Type

Required

Description

Response

The response returns the file contents with appropriate content-type headers:

XLSX exports: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
CSV exports: text/csv

The export must have status FINISHED before you can download it. Attempting to download an incomplete export will result in an error.

Example

Complete Export Script

Filter Syntax

Both filter and mutable_filter parameters use SCIM filter syntax (RFC 7644), not SQL syntax.

SCIM Operators

Operator

Description

Example

Decision Values

For mutable_filter, the decision field accepts these enum values:

Value

Description

Filter Examples

Export pending decisions only:

Use Case

Expression

Access Review Settings

API operations for customizing the behavior and functionality of Veza Access Reviews.

These endpoints can be called by providing a Veza admin user API key. See Authentication to generate a bearer token for use in requests. Note that API operations in the private namespace are subject to change as features are added or modified.

Use these APIs to configure Access Reviews Settings for Veza Access Reviews.

The settings that can be configured by a Veza administrator are:

: Automatically complete reviews once all rows have a signed-off decision, or a non-rejected signed-off decision.
: Enable review completion at any time, or only when all rows are signed off with a non-rejected decision.
: Require review creators to view and acknowledge the data source status shown at review creation.
: Enable or disable expiration of overdue reviews.
: Reject and sign off incomplete rows when a review expires.
: Prevent users from being assigned as reviewers for rows that relate to their own access and permissions.
: Configure default columns which reviewers will see when they open a review.
: Set whether notes are required when approving or rejecting access.
: Set the default sort order and sorting column when opening a review.
: Add suggested notes as menu options when reviewers approve or reject rows.
: Configure default grouping behavior for review rows to organize data by column values.
: Configure outlier detection to identify anomalous access patterns by comparing users to peer groups (Early Access, API-only).
: Control whether reviewers can export review data to CSV or PDF formats.

For each endpoint, a GET request returns the current setting, and a PUT request updates the setting. Use your unique Veza URL and API key (see ) in your request, for example:

Postman Collection

Use the Postman collection as an alternative to cURL commands for testing and configuring Veza Access Reviews global settings:

Import Instructions

To import the collection into Postman:

Open Postman and click Import in the sidebar
In the Import modal, click Choose Files
Select the access-reviews-global-settings.postman_collection.json file

Configure Variables

Before using the collection, configure these required variables on the Variables tab:

Variable

Description

Example

The collection uses Bearer token authentication. Your apiToken variable automatically populates the Authorization header for all requests.

Important: Use HTTPS (not HTTP) for your baseUrl to avoid redirect issues that can drop request bodies in PUT/POST operations.

status
abstract_permissions
concrete_permissions
updated_at
notes
reviewers
decision
decision_by
decision_by_id
decision_by_name
decision_by_email
decision_at
marked_fixed_by_id
marked_fixed_by_name
marked_fixed_by_email
marked_fixed_at
signed_off_state
signed_off_by_id
signed_off_by_name
signed_off_by_email
signed_off_at
notification_status
automation_run_ids
no_decision_or_decision_by
Is_signed_off

{
  "values": [
    {
      "id": "text",
      "description": "text",
      "name": "text",
      "workflow_id": "text",
      "filter": "text",
      "mutable_fields": {
        "decision": 1,
        "notes": "text",
        "updated_at": "2026-02-06T22:15:51.927Z",
        "updated_by": {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        },
        "notification_infos": {
          "values": [
            {
              "notification_type": 1,
              "webhook_type": 1,
              "status": 1,
              "error_message": "text",
              "updated_at": "2026-02-06T22:15:51.927Z",
              "snow_info": {
                "ticket_number": "text",
                "sys_id": "text"
              },
              "webhook_info": {
                "info": "text"
              },
              "jira_info": {
                "keys": [
                  "text"
                ]
              },
              "slack_app_info": {}
            }
          ]
        },
        "notification_status": 1,
        "reviewers": [
          {
            "user_type": "text",
            "id": "text",
            "email": "text",
            "name": "text",
            "alternate_email": "text"
          }
        ],
        "signed_off_state": 1,
        "signed_off_at": "2026-02-06T22:15:51.927Z",
        "signed_off_by": {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        },
        "action_log": {
          "entries": [
            {
              "action": 1,
              "user": {
                "user_type": "text",
                "id": "text",
                "email": "text",
                "name": "text",
                "alternate_email": "text"
              },
              "time": "2026-02-06T22:15:51.927Z",
              "note": "text",
              "reviewer_detail": {
                "old_reviewers": [
                  {
                    "user_type": "text",
                    "id": "text",
                    "email": "text",
                    "name": "text",
                    "alternate_email": "text"
                  }
                ],
                "new_reviewers": [
                  {
                    "user_type": "text",
                    "id": "text",
                    "email": "text",
                    "name": "text",
                    "alternate_email": "text"
                  }
                ]
              },
              "decision_detail": {
                "decision": 1,
                "note": "text"
              },
              "decision_cleared_detail": {
                "previous_decision": 1,
                "original_decider": {
                  "user_type": "text",
                  "id": "text",
                  "email": "text",
                  "name": "text",
                  "alternate_email": "text"
                },
                "reason": 1
              },
              "revocation_request_detail": {
                "request_id": "text"
              },
              "approval_level": 1
            }
          ]
        },
        "reviewer_assignment": {
          "users_manager": true,
          "resource_managers": true,
          "reviewers": [
            {
              "user_type": "text",
              "id": "text",
              "email": "text",
              "name": "text",
              "alternate_email": "text"
            }
          ],
          "fallback_reviewers": [
            {
              "user_type": "text",
              "id": "text",
              "email": "text",
              "name": "text",
              "alternate_email": "text"
            }
          ],
          "reviewers_managers_for_approval_levels": [
            1
          ]
        },
        "automation_run_ids": [
          "text"
        ],
        "decision_by": {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        },
        "decision_at": "2026-02-06T22:15:51.927Z",
        "revoke_request_infos": [
          {
            "id": "text",
            "state": 1,
            "error_message": "text"
          }
        ],
        "old_reviewers": [
          {
            "user_type": "text",
            "id": "text",
            "email": "text",
            "name": "text",
            "alternate_email": "text"
          }
        ],
        "predefined_question_response": [
          {
            "question_id": "text",
            "answer_id": "text",
            "answer_text": "text",
            "respondent_user": {
              "user_type": "text",
              "id": "text",
              "email": "text",
              "name": "text",
              "alternate_email": "text"
            },
            "responded_at": "2026-02-06T22:15:51.927Z"
          }
        ],
        "is_assigned_to_current_user": true
      },
      "mutable_filter": "text",
      "apply_to_all_rows": true
    }
  ]
}

POST /api/preview/awf/smart_action_definitions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2385

{
  "name": "text",
  "description": "text",
  "workflow_id": "text",
  "filter": "text",
  "mutable_fields": {
    "decision": 1,
    "notes": "text",
    "updated_at": "2026-02-06T22:15:51.927Z",
    "updated_by": {
      "user_type": "text",
      "id": "text",
      "email": "text",
      "name": "text",
      "alternate_email": "text"
    },
    "notification_infos": {
      "values": [
        {
          "notification_type": 1,
          "webhook_type": 1,
          "status": 1,
          "error_message": "text",
          "updated_at": "2026-02-06T22:15:51.927Z",
          "snow_info": {
            "ticket_number": "text",
            "sys_id": "text"
          },
          "webhook_info": {
            "info": "text"
          },
          "jira_info": {
            "keys": [
              "text"
            ]
          },
          "slack_app_info": {}
        }
      ]
    },
    "notification_status": 1,
    "reviewers": [
      {
        "user_type": "text",
        "id": "text",
        "email": "text",
        "name": "text",
        "alternate_email": "text"
      }
    ],
    "signed_off_state": 1,
    "signed_off_at": "2026-02-06T22:15:51.927Z",
    "signed_off_by": {
      "user_type": "text",
      "id": "text",
      "email": "text",
      "name": "text",
      "alternate_email": "text"
    },
    "action_log": {
      "entries": [
        {
          "action": 1,
          "user": {
            "user_type": "text",
            "id": "text",
            "email": "text",
            "name": "text",
            "alternate_email": "text"
          },
          "time": "2026-02-06T22:15:51.927Z",
          "note": "text",
          "reviewer_detail": {
            "old_reviewers": [
              {
                "user_type": "text",
                "id": "text",
                "email": "text",
                "name": "text",
                "alternate_email": "text"
              }
            ],
            "new_reviewers": [
              {
                "user_type": "text",
                "id": "text",
                "email": "text",
                "name": "text",
                "alternate_email": "text"
              }
            ]
          },
          "decision_detail": {
            "decision": 1,
            "note": "text"
          },
          "decision_cleared_detail": {
            "previous_decision": 1,
            "original_decider": {
              "user_type": "text",
              "id": "text",
              "email": "text",
              "name": "text",
              "alternate_email": "text"
            },
            "reason": 1
          },
          "revocation_request_detail": {
            "request_id": "text"
          },
          "approval_level": 1
        }
      ]
    },
    "reviewer_assignment": {
      "users_manager": true,
      "resource_managers": true,
      "reviewers": [
        {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        }
      ],
      "fallback_reviewers": [
        {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        }
      ],
      "reviewers_managers_for_approval_levels": [
        1
      ]
    },
    "automation_run_ids": [
      "text"
    ],
    "decision_by": {
      "user_type": "text",
      "id": "text",
      "email": "text",
      "name": "text",
      "alternate_email": "text"
    },
    "decision_at": "2026-02-06T22:15:51.927Z",
    "revoke_request_infos": [
      {
        "id": "text",
        "state": 1,
        "error_message": "text"
      }
    ],
    "old_reviewers": [
      {
        "user_type": "text",
        "id": "text",
        "email": "text",
        "name": "text",
        "alternate_email": "text"
      }
    ],
    "predefined_question_response": [
      {
        "question_id": "text",
        "answer_id": "text",
        "answer_text": "text"
      }
    ],
    "is_assigned_to_current_user": true
  },
  "mutable_filter": "text",
  "apply_to_all_rows": true
}

PUT /api/preview/awf/smart_action_definitions HTTP/1.1
Host: your-tenant.vezacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2407

{
  "value": {
    "id": "text",
    "description": "text",
    "name": "text",
    "workflow_id": "text",
    "filter": "text",
    "mutable_fields": {
      "decision": 1,
      "notes": "text",
      "updated_at": "2026-02-06T22:15:51.927Z",
      "updated_by": {
        "user_type": "text",
        "id": "text",
        "email": "text",
        "name": "text",
        "alternate_email": "text"
      },
      "notification_infos": {
        "values": [
          {
            "notification_type": 1,
            "webhook_type": 1,
            "status": 1,
            "error_message": "text",
            "updated_at": "2026-02-06T22:15:51.927Z",
            "snow_info": {
              "ticket_number": "text",
              "sys_id": "text"
            },
            "webhook_info": {
              "info": "text"
            },
            "jira_info": {
              "keys": [
                "text"
              ]
            },
            "slack_app_info": {}
          }
        ]
      },
      "notification_status": 1,
      "reviewers": [
        {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        }
      ],
      "signed_off_state": 1,
      "signed_off_at": "2026-02-06T22:15:51.927Z",
      "signed_off_by": {
        "user_type": "text",
        "id": "text",
        "email": "text",
        "name": "text",
        "alternate_email": "text"
      },
      "action_log": {
        "entries": [
          {
            "action": 1,
            "user": {
              "user_type": "text",
              "id": "text",
              "email": "text",
              "name": "text",
              "alternate_email": "text"
            },
            "time": "2026-02-06T22:15:51.927Z",
            "note": "text",
            "reviewer_detail": {
              "old_reviewers": [
                {
                  "user_type": "text",
                  "id": "text",
                  "email": "text",
                  "name": "text",
                  "alternate_email": "text"
                }
              ],
              "new_reviewers": [
                {
                  "user_type": "text",
                  "id": "text",
                  "email": "text",
                  "name": "text",
                  "alternate_email": "text"
                }
              ]
            },
            "decision_detail": {
              "decision": 1,
              "note": "text"
            },
            "decision_cleared_detail": {
              "previous_decision": 1,
              "original_decider": {
                "user_type": "text",
                "id": "text",
                "email": "text",
                "name": "text",
                "alternate_email": "text"
              },
              "reason": 1
            },
            "revocation_request_detail": {
              "request_id": "text"
            },
            "approval_level": 1
          }
        ]
      },
      "reviewer_assignment": {
        "users_manager": true,
        "resource_managers": true,
        "reviewers": [
          {
            "user_type": "text",
            "id": "text",
            "email": "text",
            "name": "text",
            "alternate_email": "text"
          }
        ],
        "fallback_reviewers": [
          {
            "user_type": "text",
            "id": "text",
            "email": "text",
            "name": "text",
            "alternate_email": "text"
          }
        ],
        "reviewers_managers_for_approval_levels": [
          1
        ]
      },
      "automation_run_ids": [
        "text"
      ],
      "decision_by": {
        "user_type": "text",
        "id": "text",
        "email": "text",
        "name": "text",
        "alternate_email": "text"
      },
      "decision_at": "2026-02-06T22:15:51.927Z",
      "revoke_request_infos": [
        {
          "id": "text",
          "state": 1,
          "error_message": "text"
        }
      ],
      "old_reviewers": [
        {
          "user_type": "text",
          "id": "text",
          "email": "text",
          "name": "text",
          "alternate_email": "text"
        }
      ],
      "predefined_question_response": [
        {
          "question_id": "text",
          "answer_id": "text",
          "answer_text": "text"
        }
      ],
      "is_assigned_to_current_user": true
    },
    "mutable_filter": "text",
    "apply_to_all_rows": true
  }
}

Review Row Grouping

Configure default grouping behavior for review rows to organize data by column values.

Configure default grouping behavior for access review rows. When enabled, review rows are automatically organized by the specified column values, making it easier for reviewers to process large datasets by grouping related items together.

The setting allows admins to configure a default group by column and collapsed/expanded behavior, either globally or per-workflow.

Parameters

Name

Type

Required

Description

Get Row Grouping Settings

GET /api/private/workflows/access/global_settings/rows_group_by_setting

Get Global Setting

Get Workflow-Scoped Setting

Example Response

Set Row Grouping Settings

PUT /api/private/workflows/access/global_settings/rows_group_by_setting

Example: Set Global Setting

Example: Set Workflow-Scoped Setting

Response

Common Column Examples

destination.veza_unique_name - Group by resource name
source.veza_unique_name - Group by identity name
status - Group by review status

Row grouping settings apply when reviewers first load a review. Users can manually change grouping options in the review interface regardless of these default settings. When configured for a specific review configuration (using workflow_id), those settings override any global grouping settings for reviews created from that configuration.

Grouping helps organize large reviews by collecting related rows together, making it easier to identify patterns and make decisions efficiently. Common grouping strategies include grouping by department, resource type, permission level, or risk assessment.

Outlier Detection

Configure outlier detection settings to identify anomalous access patterns in Access Reviews.

Early Access Feature: Outlier Detection is currently in Early Access and available via API only. The feature and API are subject to change. Contact your Veza Customer Success Manager to enable this feature for your tenant.

Configure outlier detection to automatically identify and flag anomalous access patterns during Access Reviews. The Manager-Centric algorithm compares each user's access to their peer group and detects access held by fewer than a specified threshold percentage of peers, helping reviewers focus on unusual or potentially risky permissions.

How Outlier Detection Works

The Manager-Centric outlier detection algorithm uses statistical analysis to identify rare access patterns:

Peer Grouping: Users are grouped based on configurable properties (default: users sharing the same manager)
Statistical Analysis: For each destination (resource/permission) in the review, Veza calculates what percentage of the peer group has access using the Wilson score confidence interval method at 95% confidence
Threshold Comparison: Access paths where the statistical lower bound is at or below the configured threshold are flagged as outliers

Default Behavior

By default, outlier detection uses:

Grouping: Users with the same manager (manager_idp_unique_id property)
Threshold: 15% (access held by ≤15% of peers is flagged as an outlier)

Example Scenario

Consider an Access Review for Okta groups:

100 users report to Manager A
95 of them have access to the "Engineering-All-Hands" group
5 users have access to the "Admin-Production-Access" group

Given a 15% threshold:

"Engineering-All-Hands" access (95% of peers) is not flagged, as this is normal access
"Admin-Production-Access" (5% of peers) is flagged as an outlier, as this is rare access

The reviewer sees a warning on those 5 rows that this access is anomalous within the peer group — no more than 15% of peers with shared characteristics have it.

API Endpoints

Administrators can customize outlier detection using APIs:

Get Outlier Detection Configuration

GET /api/private/workflows/access/global_settings/manager_centric_config

Retrieve the current outlier detection configuration, either globally or for a specific review configuration.

Parameters

Name

Type

Required

Description

Example: Get Global Configuration

Example: Get Configuration for Specific Review

Response

Set Outlier Detection Configuration

PUT /api/private/workflows/access/global_settings/manager_centric_config

Update the outlier detection configuration globally or for a specific review configuration.

Parameters

Name

Type

Required

Description

Example: Set Global Configuration

Example: Set Configuration for Specific Review

Response

Grouping Properties

Grouping properties define how users are organized into peer groups for outlier analysis. You can specify properties from:

Source nodes (the users/identities in the review)
Destination nodes (the resources/permissions being reviewed)
Enriched/joined nodes (additional data joined to the query, such as manager information from an IdP)

Property Reference Schema

Each property reference has these fields:

Field

Type

Required

Description

Target Node Types

SOURCE Node Properties

Properties from the source entities in the review (typically users/identities).

Common source properties:

department - User's department
location - User's location
manager_idp_unique_id - User's manager identifier (default)

Example:

DESTINATION Node Properties

Properties from the destination entities (resources/permissions being reviewed).

Common destination properties:

classification - Resource classification level
data_sensitivity - Data sensitivity level
owner - Resource owner

Example:

JOINED Node Properties (Enrichment)

Properties from enriched/joined metadata from another data source. These require the review query to include a JoinNodeSpec that joins additional data (such as manager information from an IdP).

Example:

This groups all users by their manager's department, requiring the review query to join the manager data with the alias "manager".

Configuration Examples

Example 1: Default Manager-Based Grouping

Groups users by manager with a 15% threshold (default configuration):

Use case: Identify access that's unusual compared to direct peers reporting to the same manager.

Example 2: Department and Location Grouping

Groups users by both department and location with a 10% threshold:

Use case: Identify access that's rare among users in the same department and office location.

Example 3: No Grouping (Population-Wide)

Compares each user to the entire population with 5% threshold:

Use case: Flag extremely rare access across the entire organization, regardless of role or department.

Example 4: Resource Classification Grouping

Groups by destination resource classification with a 20% threshold:

Use case: Identify unusual access patterns within resources of the same classification level.

Example 5: Manager's Department (Enrichment)

Groups by the manager's department (requires query enrichment) with a 15% threshold:

Use case: Identify access that's unusual among users whose managers are in the same department, useful in matrix organizations.

Use Cases

Finance Audit Compliance

Scenario: Reviewing access to financial systems where SOX compliance requires attention to outlier access.

Configuration:

Users with access held by ≤5% of their department peers are flagged for additional scrutiny.

Engineering Production Access

Scenario: Reviewing production system access where most engineers shouldn't have admin rights.

Configuration:

Identifies engineers with production access that is unusual within their team, considering the environment.

Role-Based Access Review

Scenario: Reviewing access where job role should predict permissions.

Configuration:

Flags access held by ≤15% of users with the same job role, indicating potential role creep or over-provisioning.

Cross-Department Anomaly Detection

Scenario: Detecting access patterns that are unusual for an entire department.

Configuration:

Identifies access held by ≤8% of users in the same department and location, flagging potentially inappropriate cross-functional access.

Important Considerations

Configuration Scope: Settings can be applied globally (affecting all new reviews by default) or per-review configuration. Review-specific settings override global settings for reviews created from that configuration.

Property Availability: Grouping properties must exist in your access review query results. If a specified property doesn't exist for source/destination/joined nodes, outlier detection may not function as expected. Verify property names match your data schema.

Statistical Confidence: The algorithm uses the Wilson score confidence interval at 95% confidence level to ensure statistically sound outlier detection even with small peer groups. Peer groups with fewer than 3 members are excluded from outlier analysis to maintain statistical validity.

Threshold Tuning: Start with the default 15% threshold and adjust based on your organization's risk tolerance:

Lower thresholds (5-10%): More sensitive, flags only the rarest access

Enrichment Requirements: When using TARGET_NODE_JOINED properties, ensure your Access Review query includes the corresponding JoinNodeSpec with the matching alias. See for enrichment configuration.

- Overview of all Access Reviews settings
- Complete Access Reviews documentation

Access Reviews APIs

hashtagCore Workflow Operations

hashtagQuick start

Workflow Parameters Reference

hashtagWorkflow Properties

List Workflows

hashtagExamples

hashtagRequest

hashtagResponse

List Certifications

Update Certification Result

hashtagParameters

hashtagRe-assigning reviewers

hashtagExamples

hashtagReject with note

hashtagChange the reviewer to a Custom IdP user

hashtagAssign a local user as a reviewer

hashtagResponse

Access Reviews APIs

hashtagCore Workflow Operations

hashtagQuick start

List Workflows

hashtagExamples

hashtagRequest

hashtagResponse

Workflow Parameters Reference

hashtagWorkflow Properties

List Certifications

hashtagCertification Properties

hashtagResult Properties

hashtagResultNode

hashtagWorkflowUser

hashtagActionLog

hashtagReviewerAssignmentInstructions

hashtagExamples

Update Certification Result

hashtagParameters

hashtagRe-assigning reviewers

hashtagExamples

hashtagReject with note

hashtagChange the reviewer to a Custom IdP user

hashtagAssign a local user as a reviewer

hashtagResponse

Create Certification

hashtagOverview

Update Webhook Info

hashtagEndpoint

hashtagRequest Body

hashtagDynamic Information

hashtagIdentity Object

hashtagReviewer Assignment

hashtagResponse

hashtagExamples

hashtagBasic Certification

hashtagDynamic Filtering (Joiner/Mover/Leaver)

hashtagMulti-Level Review

hashtagIdentity Types

hashtagSee Also

Manage Reviewer Deny List

hashtagGet Deny List

hashtagAdd User

hashtagRemove User

Smart Action Definitions

Force Update Result

hashtagAdd smart action definition

hashtagMutable fields and mutable filters

hashtagRemove a smart action definition

hashtagList smart action definitions

hashtagUpdate a smart action definition

hashtagParameters

hashtagSample Request

hashtagSample Response

Quick Filters

hashtagExamples

hashtagAdd a quick filter

hashtagList all quick filters

hashtagRemove quick filter by quick filter id

List Certification Results

List Reviewer Infos

hashtagExamples

Core Workflow Operations

Quick start

Workflow Properties

Examples

Request

Response

Parameters

Re-assigning `reviewers`

Examples

Reject with note

Change the reviewer to a Custom IdP user

Assign a local user as a reviewer

Response

Core Workflow Operations

Quick start

Examples

Request

Response

Workflow Properties

Certification Properties

Result Properties

ResultNode

WorkflowUser

ActionLog

ReviewerAssignmentInstructions

Examples

Parameters

Re-assigning `reviewers`

Examples

Reject with note

Change the reviewer to a Custom IdP user

Assign a local user as a reviewer

Response

Overview

Endpoint

Request Body

Dynamic Information

Identity Object

Reviewer Assignment

Response

Examples

Basic Certification

Dynamic Filtering (Joiner/Mover/Leaver)

Multi-Level Review

Identity Types

See Also

Get Deny List

Add User

Remove User

Add smart action definition

Mutable fields and mutable filters

Remove a smart action definition

List smart action definitions

Update a smart action definition

Parameters

Sample Request

Sample Response

Examples

Add a quick filter

List all quick filters

Remove quick filter by quick filter id

Examples

Examples

Request

Response

Examples

Add user delegations

List user delegations

Remove user delegations

Examples

Parameters

Get Data Source Acknowledgement Setting

Set Data Source Acknowledgement Setting

Parameters

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Parameters

Parameters

Parameters

Valid Values