OAA Entity Owners

Overview

OAA supports setting Entity Owners on OAA Entities as part of the submission for some templates. This enables a single operation to submit the OAA Entity and its owner.

Entity Owners enable automated assignment and accountability in access management and other workflows:

• Owners can be used by Access Workflows for automatic assignment of review rows

• Assigning owners for entities that represent non-human identities enables visibility into those users on the Non-Human Identities (NHI) overview page.

• If Veza assigns a Risk Score to the entity, an owner assignment can help identify the user best able to remediate the risk.

Supported Templates and Entity Types

Currently supported OAA Templates and entity types for Entity Owners:

Application Template:

• Application (owners can be set at the application level itself)

• Users

• Groups

• Roles

• Resources

• Access Credentials

Requirements:

Entity Owners must be a User entity type from an Identity Provider integration enabled in Veza. If a Global Identity provider is configured, the owner must be a user entity from the Global IDP.

Entity Owner Entry

Use the owners property on supported entities to specify entity owners as an array of objects.

{
    "external_id": "[email protected]",
    "owner_type": "OktaUser",
    "primary": true
}

Example Usage

For example, setting the owner on a role may look like the following:

      "local_roles": [
        {
          "name": "User Admin",
          "permissions": [
            "view_all",
            "manage_users"
          ],
          "owners": [
            {
              "external_id": "[email protected]",
              "owner_type": "OktaUser",
              "primary": true
            }
          ]
        }
      ]

Owner Type Values

For custom identity providers, you will need to determine the correct owner_type format to identify the entities in Veza Graph. You can find this information through the Veza UI or using an API request:

In the Veza UI:

1. Go to Access Visibility > Graph

2. Search for a user from your custom identity provider

3. Click on the user to open the sidebar and choose Basic Actions > View Details

4. The entity type is displayed in the user details (e.g., "OAA.Custom_IDP.IDPUser")

5. Use this exact node type as your owner_type value

Alternately, you can use GET /api/v1/providers/custom to list all custom providers and their idp_type values. The owner_type format should be OAA.{idp_type}.IDPUser

See the table below for common IdP types and corresponding owner entity types:

Warnings and Errors

If an Owner entry is malformed, references an unsupported owner type, or conflicts with the Global IDP setting a Field Violation error will be returned and the OAA payload will be rejected.

If an owner identity cannot be found, a warning will be returned with the successful response and the OAA payload will be accepted and processed with the unknown owner(s) being ignored.

Entity owners must originate from the primary Global IdP source. Users from alternate manager lookup sources cannot be used as entity owners.

Next Steps

After submitting an OAA payload with entity owners, verify the assignment by locating the entity in Query Builder or Graph Search. You can then configure automatic reviewer assignment to use these owners in access review workflows.