curl 'https://{{VezaUrl}}/api/v1/graph/nodes/veza_tags' \
  --data-raw '{
      "node_id":"arn:aws:s3:::aws-cloudtrail-logs-527398259632-c98becd0",
      "tags":[
          {"key":"custom_tag","value":"one"}
        ]
    }'

Quick Start

For the examples below, BASEURL should be the address of your Veza instance, such as https://<org>.vezacloud.com.

export BASEURL=https://<org>.vezacloud.com} \
export TOKEN=Sk9lcmEta2w2c2padklkaDhOcDVhTWdVU3FlTlpVajg=

Use Get Query Spec Nodes to find Snowflake tables reachable by federated Okta users belonging to the Finance department:

curl $BASEURL/api/v1/assessments/query_spec:nodes \
  -H 'authorization: Bearer '$TOKEN \
  --data-raw '{
  "query_type": "SOURCE_TO_DESTINATION",
  "include_nodes": true,
  "source_node_types": {
    "nodes": [
      {
        "node_type": "SnowflakeTable"
      }
    ]
  },
  "destination_node_types": {
    "nodes": [
      {
        "node_type": "OktaUser",
        "condition_expression": {
          "specs": [
            {
              "fn": "CONTAINS",
              "property": "department",
              "value": "Finance"
            }
          ]
        }
      }
    ]
  }
}'

The response will include the table id:

{
  "values": [
    {
      "id": "dn44266.us-east-2.aws.snowflakecomputing.com/database/LOCATION/schema/COUNTRIES/table/USA",
      "type": "SnowflakeTable",
      "properties": {
        "created_at": "2021-05-14T21:18:55Z",
        "name": "USA"
      },
      "destination_node_count": 1,
      "permissions": []
    }
  ],
  "next_page_token": "MzA=",
  "has_more": false
  }

Apply a tag by specifying a key and optional value:

curl $BASEURL/api/v1/graph/nodes/veza_tags \
  -H 'authorization: Bearer '$TOKEN \
  --data-raw '{
  "node_id": "dn44266.us-east-2.aws.snowflakecomputing.com/database/LOCATION/schema/COUNTRIES/table/USA",
  "tags": [
    {
      "key": "department",
      "value": "finance"
    }
  ]
  }'

Remove a tag by providing the entity id and the tag key to delete:

  curl $BASEURL/api/v1/graph/veza_tags:remove \
  -H 'authorization: Bearer '$TOKEN \
  --data-raw '{
  "node_id": "dn44266.us-east-2.aws.snowflakecomputing.com/database/LOCATION/schema/COUNTRIES/table/USA",
  "tag_key": "department"
  }'

New in 2022.3.2: Tagging operations are now available as part of the v1/ API set.

Methods

Create Veza Tag

Post {VezaURL}/api/v1/graph/tags

Define a new tag that can be applied to any discovered entity, as a key:value pair. The tag value is optional.

{
    "tag": {
        "key": "note",
        "value": "tags_can_be_used_as_searchable_properties,_or_add_extended_notes"
    }
}

A successful response will be empty ({}).

Add Veza Tag

Post {VezaURL}/api/v1/graph/nodes/tags

Apply one or more tags to an entity by providing an entity ID. A new Tag will be created if one doesn't already exist.

{
    "node_id": "080551dc-aef9-46e4-9654-a6362d7baeee",
    "tags": [
        {
            "key": "PII",
            "value": "GRPC"
        }
        {
            "key": "environment",
            "value": "production"
        }
    ]
}

To retrieve an entity ID, you can use the Query Builder API, or browse the Identity Data Entities catalog.

Remove Veza Tag

Post {VezaURL}/api/v1/graph/nodes/tags:remove

Remove a tag from an entity.

{
	"node_id": "080551dc-aef9-46e4-9654-a6362d7baeee",
	"tag_key": "environment"
}

A successful response will be empty ({}).

Use these APIs to define the tags Veza should treat as customer-defined properties. Access Reviews that involve these entity types will include columns showing the tag name and value.

For example, in AWS, you may automatically tag identities with a 3rd-party security tool, or use tags to label S3 buckets containing sensitive data. When a tag is promoted, Veza Access Reviews will treat the tag as a built-in entity attribute, and show this information for reviewers in an optional column.

Promote tag

Add a promotion rule by specifying its type and key, and the entity types it applies to:

• include_entity_types: if true, promote tags for the listed type(s).

• exclude_entity_type: if true, promotes tags for all entities except the listed type(s).

• AWSTag

• CookieTag (Veza Tag)

• GoogleCloudLabel

Entity types for tag promotion should be concrete types. You can confirm the format by viewing details for any graph node, and checking the Type attribute, for example:

• OAA.PagerDuty.User

• ActiveDirectoryUser

• OAA.custom_idp.IDPUser

Demote tag

Remove a promotion rule for the specified tag key and type. Demotions apply on the next data source parse.

List tag promotions

Get all promotion rules for all entity types.