These endpoints enable listing workflows, listing certifications, getting certification results, and updating certifications. They can be used to programmatically retrieve workflow and certification details, and update certification rows with a decision or note, such as ticket number.

These endpoints also provide utility functionality, such as managing the reviewer deny list, populating results with webhook response info, and customizing quick filters, smart actions, and help pages.

Core Workflow Operations

• List Workflows

APIs for Veza Access Reviews are subject to change, and as such are provided with the /preview API collection. Use the appropriate prefix when calling the API, for example, your-org.vezacloud.com/api/preview/.

First, save your and Veza base URL as environment variables:

Get all workflows and IDs:

Use a workflow id to get active and pending certifications for that workflow:

The response will include certification details, including the certification ids.

Using a certification id, you can get results for the certification, including entity attributes:

Update a certification result row with a note:

Updates webhook status and details for a certification result.

If you have configured a custom webhook to conduct automated access removal or another form of remediation, you can update Veza with the notification status.

Your application can use this endpoint to send a POST request updating the webhook state, visible to other reviewers from Veza's Certification UI.

This endpoint can also be called during the 7-day grace period after a certification completes or expires. Calls during the grace period require the admin, Access Reviews Admin, or operator role.

Path parameters

certification_id - id of the certification containing the result to update.

Body

The request body must include the id of the result to update. Valid notification_status are:

• PENDING

• SUCCEED

• FAILED

Webhook_info strings can contain up to 255 bytes.

Response

A successful response will be empty {}

By default, when a reviewer approves a row, a "notes" pop-up appears, allowing the user to optionally add a note explaining their decision. When a reviewer rejects a row, the "notes" pop-up appears, and adding a note is required. This API allows you to customize this behavior. For example, you can choose to disable the pop-up when a row is approved and make the notes pop-up optional when a row is rejected.

Additionally, this API can enable the historical "Approve & Signoff" action in the reviewer experience when multiple rows are selected. Note: It is recommended that this feature remains disabled to ensure a more streamlined reviewer experience.

Parameters

accept_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

• POP_UP_REQUIRED = 3

reject_notes_behavior can be:

• NOTES_BEHAVIOR_UNKNOWN = 0

• NO_POP_UP = 1

• POP_UP_OPTIONAL = 2

approve_and_sign_off_button_behavior can be:

• HIDE_OR_SHOW_BEHAVIOR_UNKNOWN = 0

• SHOW = 1

• HIDE = 2

diff_dropdown_behavior can be:

• NORMAL = 1 (Enables all users to see decisions and access changes from previous reviews for the same configuration)

• ALWAYS_HIDE_FOR_ACCESS_REVIEWER_ROLE = 2 (Prevents users with the "Access Reviewer" role from accessing this option)

This setting is configurable on the Access Reviews > Settings page. Enable Auto-Expire overdue reviews to automatically expire reviews that aren't completed by the due date.

Enables or disable expiration of overdue reviews. By default, overdue reviews are not expired and remain available to reviewers. When expiration is enabled, the review will be "expired" when it becomes overdue. An expired review is read-only and is not shown to reviewers.

Parameters

The value can be True or False.

Get Expire Overdue Reviews Setting

Set Expire Overdue Reviews Setting

Enable or disable the "auto-complete" feature. When auto-complete is enabled, a review will automatically be completed once all rows have a signed-off decision, or a non-rejected signed-off decision, depending on the "Completion Allowed Settings."

Parameters

Possible values are:

• AUTO_COMPLETE_UNKNOWN

• AUTO_COMPLETE_ENABLED

• AUTO_COMPLETE_DISABLED

By default, when a review is created, a user can optionally view the status of the data sources involved in the review. This API allows the behavior to change, requiring that the data source status is shown to the user and acknowledged during review creation.

Parameters

Possible values are:

• DATASOURCE_ACKNOWLEDGEMENT_UNKNOWN = 0

• DATASOURCE_ACKNOWLEDGEMENT_NOT_SHOWN = 1

• DATASOURCE_ACKNOWLEDGEMENT_REQUIRED = 2

Enable or disable self-review prevention. When self-review prevention is enabled, users are prevented from being assigned as reviewers for rows that relate to their own access and permissions.

The value can be either an integer or string:

• SELF_REVIEWER_CHECKING_DISABLED = 1 (or "SELF_REVIEWER_CHECKING_DISABLED" as string)

Configure predefined notes as menu options when reviewers approve or reject rows. This feature can be configured globally for all reviews or specifically for individual review configurations. When configured for a specific review configuration (using workflow_id), those settings override any global predefined notes.

The predefined notes appear as selectable options in the notes dialog when making decisions, suggesting standardized responses alongside free-form text entry.

The request body accepts:

• reject_notes: Array of predefined note options shown when rejecting rows

This setting is configurable on the Access Reviews > Settings page. Enable Reject incomplete rows to reject and sign off on undecided rows when a review expires.

This API allows you to change the behavior when a review expires (which can be enabled in Review Auto-Complete Settings). Depending on the behavior, incomplete rows can be auto-rejected when the review deadline passes.

Review expiration behavior can be configured globally, or for all reviews for a single Review Configuration, specified by workflow_id in the request.

The request body must include a setting object with the following structure:

An Admin or Operator user can complete a review by clicking the "Complete Review" button.

Once a review is marked as "completed," it becomes read-only and is no longer visible to reviewers. By default, a review can be completed when all rows have a signed-off decision.

This API allows you to modify this behavior, enabling a review to be completed at any time, or only when all rows are signed off with a non-rejected decision. The latter option is useful if your organization prefers to complete reviews only after all rejected access has been remediated.

Possible values are:

• COMPLETION_ALLOWED_UNKNOWN

This page describes common properties for listing workflows, certifications, and certification results:

Workflow Properties

When listing access workflows, all Veza Workflows are returned within a values array. Each has the properties:

returns all Certifications for a workflow, within a values array.

Note that to maintain certification integrity, some properties are immutable and can't be modified, while other values system-updated. Mutable fields such as "name," "notes," "reviewers" and "due date" can be changed by operators and admins using the Veza UI:

See for more details on query construction.

Internal fields are updated by the workflow service to store important metadata:

States can be:

• CERT_STATE_SEARCHING // The query is still running

• CERT_STATE_IN_PROGRESS // the certification is being reviewed

• CERT_STATE_COMPLETED

include a numeric ID, the query details, and any decisions and notes. Each result includes entity details for the source -> destination nodes and the cumulative permissions under review:

Valid decisions are:

1. RESULT_DECISION_NONE // No decision has been made

2. RESULT_DECISION_ACCEPTED // The access described in the result row is acceptable

3. RESULT_DECISION_REJECTED

Both the number or string value for the decision are allowed, for example "decision": 4 or "decision": RESULT_DECISION_FIXED.

The notes field will always contain the most recent note. Previous notes can be reviewed in the using the List Cert Results API.

Shows source, destination, or intermediate entity details for a query result:

Reviewer details, typically a Veza user account. If are configured, the user type and id refer to Veza graph entities:

You can get details for a local Veza user from Administration > User Management. For graph entities (identities from an external identity provider), inspect the entity details using Access Search or the Entities page. will return all users for a given certification.

• When assigning reviewers using preview Workflows APIs, requested users are validated before assigning them to a certification result, and not assigned when the user can’t be found. Assignee id and user_type are required to identify reviewers. name and email are optional but if provided must match the Veza user record.

Results contain a record of all prior actions on a certification result.

Possible actions are:

• NOTE_ADDED

• REVIEWER_ASSIGNED

• DECISION

The response will include the type, id, email, and name of the user who made the change:

The reviewer_assignment specifies how reviewers should be assigned to rows, during initial certification create or when reviewers are re-assigned by smart action.

users_manager and resource_managers assigns reviewers based on Global IdP settings.

reviewers is a way to specify one or more reviewers to apply to every row. fallback_reviewers is one or more reviewers that to assign to rows if auto assign by user or resource manager fails for any reason

Control whether reviewers can view and export access review data. This setting provides granular control over different export formats, allowing administrators to enable or disable CSV and PDF exports independently based on organizational security policies.

When enabled, reviewers can export review data in the allowed formats for offline analysis or reporting. When disabled, the corresponding export options are hidden from the reviewer interface, ensuring review data remains within the Veza platform.

The default setting disables both CSV and PDF exports for security. This setting can be configured globally for all reviews or for specific review configurations using the workflow_id parameter.

Parameters

The request body accepts:

• allow_csv_exports (boolean) - Enable or disable CSV export functionality for reviewers

• allow_pdf_exports (boolean) - Enable or disable PDF export functionality for reviewers

• workflow_id (optional string) - Specific review configuration ID to override global settings

Example request body:

Retrieve the current reviewer export permission settings. Include the optional workflow_id query parameter to get settings for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

Update the reviewer export permission settings globally or for a specific review configuration.

Global Settings Request:

Configuration-Specific Request:

Example response:

ForceUpdateAwfResults allows administrators to modify results more than normally allowed, such as changing sign-off status, or changing a row's decision after a certification expires.

View or change the deny list for reviewer auto assignment.

Adding a user to the deny list will prevent that user from being auto assigned as a reviewer. That user will also be prevented from appearing in the drop-down menu when manually reassigning a user.

If a user's manager is on the deny list when auto assignment occurs, the certification will be assigned to the that manager's manager. If both the manager and the manager's manger are on the deny list, the result will be assigned to the workflow creator.

Returns the current denied users.

Configure the ordered list of fallback selection methods that Veza uses when a valid reviewer cannot be assigned. When all specified reviewers are prevented from assignment (due to self-review prevention, the reviewer deny list, or missing managers/owners), Veza evaluates each selection method in order until an allowed alternate reviewer is found.

For more information, see .

The selection_methods array accepts integer or string values representing fallback methods to enable. Enabled methods are evaluated in the specified order.

Administrators can configure delegate reviewers for who would otherwise be assigned or auto-assigned to certification results. Specifying a delegate reviewer for another Veza user allows them to fulfill the responsibilities of that user — for example, if a manager is on leave, out-of-office, or otherwise unavailable.

• Any certification items assigned to the original reviewer are also assigned to the delegated reviewer.

• Delegate reviewers are notified of the assignment and receive notifications in place of the original reviewer. They can review and sign-off on any results assigned to the original reviewer.

• The original reviewer can still act on results, but will not receive assignment or reminder emails.

The JSON payload contain pairs of original and delegate . You can use to get all the required details for reviewers assigned to a certification.

Add delegation for Veza system users:

A successful response will be empty.

You can map both local Veza users and identities from an .

Add delegation for Okta users (with IdP settings configured):

Note that this assumes the IdP setting are configured to use "idp_unique_id" to correlate identities, as in the Okta example .

A successful response will list all configured delegations, contained in a values array:

To remove delegations, post the configuration to /api/preview/awf/delegation/users:remove.

A successful response will be empty.

Define filter-based actions that reviewers can apply to certifications results with a matching attribute or status.

Reviewers can view and apply custom actions from the Review interface by clicking Smart Action > Prepared Actions.

• Add smart action definition

Create a smart action definition, globally or for a single Workflow.

A certification includes all source and destination node properties discovered or added by Veza. You can specify a SCIM filter to select the results to affect, for example:

Example request:

The filter can apply to any source or destination node property.

When apply_to_all_rows is true and no other filter criteria is specified, the action will run on all certification results.

Mutable fields contain result attributes that are not sourced from Access Graph metadata. Use mutable_fields to apply changes to a result, and mutable_filter to filter results based on decision or sign-off state:

Delete a prepared action by definition id.

Returns an array of smart action definitions. By default, this endpoint lists all definitions. If a workflow_id is specified, only definitions for that workflow are included in the response.

Alter a smart action definition by specifying the id and an array of values to change.

Use these APIs to configure for Veza Access Reviews, or to operate on a specific Review Configuration.

• : Duplicate an existing access review configuration under a new name, carrying over notifications, Veza Actions, and per-configuration settings.

The settings that can be configured by a Veza administrator are:

• : Automatically complete reviews once all rows have a signed-off decision, or a non-rejected signed-off decision.

Apply a decision, note, sign-off, or reviewer change to a numbered certification result.

Each row of the certification results can be annotated, marked as ACCEPTED, or REJECTED, signed-off, or assigned to a different reviewer.

Parameters

value must include the result_id and any mutable fields to update:

Valid decisions are:

• NONE // No decision has been made

• ACCEPTED // The access described in the result row is acceptable

• REJECTED

Adding a note overwrites the previous value. Historical notes are included in the action log when . When viewing the row in the UI, only the most recent note is shown.

During the 7-day grace period after a certification completes or expires, updating row notes is permitted for the admin, Access Reviews Admin, and operator roles. Other update operations are restricted during this window. For a full summary of grace period permissions, see .

A result’s reviewer can be reassigned by updating the reviewers field with a list of one or more Access Workflow User objects:

Note that all fields are required when assigning a reviewer. As of the current release, there is no customer-facing API to get local user ids. For this reason, API-based reviewer reassignment is recommended only when a graph IdP is configured as the , and you can programmatically retrieve required identifiers such as user "name," "id," and "email."

A successful response will be empty: {}.

Use these operations to add and manage help pages for access reviewers, and customize pop-up messages when a review starts, or when rows are signed off.