1 of 24

Query APIs

Creating new queries, interacting with saved queries, and running query specs

The Query Builder APIs enable programmatic creation, execution, and management of assessment queries, using the Veza the Query Builder. You can use these operations to develop your own tools and integrate Veza search with external services and automation.

Queries created with these endpoints can define risks and have rules and alerts associated with them. Even if you and your team create and manage queries primarily from the user interface, this documentation may still be of interest for learning how queries are constructed and handled within Veza.

You can use these methods to:

List saved queries

For more information about query options, see .

Base URL

These endpoints are available under {{VezaURL}}/api/v1/. You must use the appropriate prefix when calling the API, for example:

Authentication

You can create and manage for your user account from Administration > API Keys. Each API call must include the API key in the request header, passed as a bearer authentication token.

Getting started

The page consolidates some sample requests and responses.

An understanding of Veza's usage of may be helpful. To learn more about the query object and options, see . For more information about how to interpret the query response body, see .

You can start working with pre-built and saved queries using the /assessments/queries endpoint. When you are ready to try running your own queries, see the operations to run test queries without saving them.

Quick Start

API overview and sample queries

The Query Builder is fundamental to Rules and Risks, enabling external notifications and enhanced search visibility based on query constraints and conditions. When combined with Webhooks for remediation workflows, these can offer in-the-box tools to begin integrating Veza with external processes.

As Veza does not write changes to your environment, you can use the query builder API to build your own tools and integrate Veza with your internal systems and security processes.

For example, you might use Veza APIs to:

Programmatically detect and add Snowflake users to a role when another role already exists with the required permissions
Progressively query for data resources matching a naming pattern or other condition, and apply tags with the provider's built-in APIs
Discover and alter overly permissive policies granting access to sensitive data

Your Veza success team can offer additional support and access to development tools including a Python SDK. This guide covers some simple examples to help get started with custom queries, including links to additional documentation.

Authentication

To run the provided commands, you'll need to first generate a token from Administration > . You'll also need to know the base URL of your Veza deployment, such as your-org.veza.com.

Query specifications

You can validate that a query is functioning as intended before saving it with , which will return the total number of entities in the search results.

returns a paginated list of query results, including entity details. This operation does not return a total count of results. A query spec does not require the full saved query , and instead takes a condensed payload.

returns the related destination nodes for a single entity in the results of a saved query. This endpoint can be used, for example, to review the related roles for an individual user when the query specifies User > Role.

Sample Request

Post your request to or , depending on whether you need a list of the included nodes (including all entity properties), or want the full result count:

See for more information about possible options.

Sample Response

The response always returns a value, next_page_token, and has_more. If more results are available, you can get the next page of results by passing the page_token in the request query.

The values array will contain the Individual entity details:

For more information, see .

Get destination nodes

Use to find the related entities for an individual result for a query spec. Specify the source_node_id of the entity to get relationships for:

Sample Request

Sample response

Save a query

If you want to run the same query repeatedly, or enable Veza or based on the results, you can save it under .

A saved query includes a name and description, along with any other .

Get saved query result count or entity details

Use the query ID to run a saved query. Just as for query_spec operations, you can request the paginated entity details or the result count, or get destination nodes for a result:

Responses will contain the node details or the total count, depending on the method used.

Query Builder Terminology

Graph search concepts for working with the query builder

Entity (Node)

An entity, also referred to as a node, represents an authorization, data, or identity object discovered by Veza. It can be a concrete external named entity, such as AwsIamPolicy or OktaUser, or an edge aggregation node created by Veza for visualization and service purposes.

Entities, within the context of the Query Builder API, are the building blocks that represent various authorization, data, and identity objects discovered by Veza. They are used to construct queries, workflows, and Authorization Graph searches.

Entities encompass a wide range of elements, including identities, local users, data resources, identity domains, and IAM or RBAC elements such as security groups, policies, and roles.

When constructing queries, you will typically specify the source and destination entity types, such as Okta User to AWS S3 Bucket or Google User to Google Group, along with specific constraints on those entity types.

The Query Builder API offers top-level Entity Type Groupings such as User and Resource, providing an easy way to select and constrain all entities belonging to a particular supertype.

Entity Attribute

An entity attribute is a key-value pair associated with a specific entity type. These attributes carry rich metadata, enabling granular filters and search conditions.

Veza will add certain properties such as name, is human, or full admin during parsing. Other attributes such as mfa_enabled and is_encrypted can be directly ingested from the provider.

Entity Type

An entity type represents the final and precise specification of a node's category in an external system. Examples of external entity types include AwsIamUser, or S3Bucket.

Entity Type Grouping

An entity type grouping, or supertype, provides a top-level label to search for multiple entity types in a single query, such as User or Resource. Constraints can apply to an entity type grouping as if it were a single entity.

Supertypes are groupings of entities in the graph, allowing the specification of a "one of" style constraint among different concrete node types. A node type can be a member of one or more supertypes, and a supertype can contain concrete node types as well as other supertypes.

Effective and System Permissions

Raw or System permissions refer to individual privileges defined in the provider's internal terms, for example, AWS IAM s3:BucketDelete.

Effective Permissions represent the canonical C/R/U/D equivalents of system permissions. For example, MetadataWrite, DataRead, NonData.

Note: When filtering by permission, you must specify the type of permission. Effective and system permissions cannot both be specified for the same query. If a search does not involve privileged relationships to resources, the permissions filter has no effect (e.g., User->Policy search).

Query Builder Parameters

Options for saved and spec query requests

When calling query spec endpoints or saving a query, you will specify the search parameters in a JSON object in the request body. Saved queries and query specifications support a range of parameters and options, described in this document.

Queries begin with a source node type and optionally a destination node type. A simple query might show "all Okta users with relationships to S3 Buckets". A more advanced query will add additional constraints on entity attributes or tags, or filter on relationships to intermediate entities, such as a role, group, or local user.

Most requests will return entities of the source node type. Use GetAssessmentQuerySpecDestinationNodes or GetAssessmentQueryDestinationNodes to return related entities for an individual source entity in a query result.

As the Veza uses these APIs, you can preview different sample requests and responses by constructing queries from the web interface, opening the Save dropdown menu, and choosing View Query Spec API.

Query parameters

Field

Type

Notes

NodeSpecCollection

A collection of node specifications, defining constraints or other query parameters on each entity type.

You can query for a single principal or resource by filtering on node ID.

Field

Type

Notes

NodeSpec

Contains the type, tags, and conditions applied to a node, narrowing the focus of the query.

Note that you can add conditions and tags to either the source node type or the destination.

Field

Type

Notes

NodeTypeGroupingConstraint

Query specs support supertypes with constraints. They can specified in the same way as concrete node types. node_type_grouping_constraint can be used to limit the concrete node type set belonging to the specified super type, with possible constraint type values EXCLUDE or INCLUDE. Example spec:

ConditionExpression

Additional constraints can be applied using a node condition_expression. Conditions specified within the expression can target node attributes such as name, date created, or any other properties Veza has discovered.

Conditions can always apply to source and destination node types. Conditions can only apply to intermediate node types when the query defines required_intermediate_node_types.

Conditions have a function (fn). Valid operators are:

EQ: 'Equals',
LT: 'Less Than',
LTE: 'Less Than or Equal',

Date-based operators can be:

LT: 'Not in the Last', LTE: 'Before', GT: 'In the Last', GTE: 'After', EQ: 'At',

For example:

The condition value can be true, false, a number, an RFC3339 timestamp, or a string. For example, to find S3 Bucket destinations where public ACLs haven't been blocked:

Conditions can also contain a string-typed value. For example, to find all Okta users with the prefix "sa-":

Note that you can specify nodes where the condition doesn't apply by setting "not": true for the constraint.

There can also be a not on the whole expression:

You can get all the properties available for different node types (which vary depending on the provider and service) by searching for the entities in Authorization Graph and viewing the node details.

No relation

Enable no_relation to only return nodes without a relationship to the destination node types. For example, to show Microsoft Azure AD users that do not belong to the group "Alabama":

Avoids intermediate node types

You may want to query for entities that have direct access to a resource, without a specific intermediate relationship. For example, you can query for IAM users whose resource access does not also involve a role.

To query for relationships that do not include a specific node type in the authorization path, specify an exclusion in the avoids_intermediate_node_types object:

Query type

Query Type

Description

When copying JSON query specifications from the Query Builder UI, you may see "query_type": "SYSTEM_CREATED" in the generated payload. When using this to create queries via the API, you must change the value to "query_type": "SOURCE_TO_DESTINATION". The API does not accept SYSTEM_CREATED as a valid query type for user-created queries, as this type is reserved for Veza's out-of-the-box queries.

Permissions

To return only entities with one or more permissions to a resource, you can list either system or effective permissions, with an AND or OR operator.

RawPermissionCollection

"Raw" or "System" permissions describe privileges using the service providers terms, for example s3:PutBucketAcl.

Field

Type

Notes

You can review all the possible permissions Veza has discovered for an entity by selecting it as a related entity in a Query Builder search. The "Permissions" dropdown menu will include all effective and raw permissions for the resource type.

EffectivePermissionCollection

Field

Type

Notes

Effective permissions are an abstraction of an entity's authorization to a resource. When discovering authorization metadata for a connected provider, Veza maps each raw permission a principal has on a resource to the corresponding canonical permission, and calculates the cumulative effective permissions.

RelatesToExp

Queries constructed using the v1 API and the Segregation of Duty page can use "relates to" expressions to get results based on relationships to more than one related entity types, with AND | OR logic. For example: Show all users that are in Group A and Group B, or Show users that are in Group X and have Role Y.

RelatesToExp Evaluation

For E = { specs: [A, B, ...], child_expressions: [X, Y, ...], operator, not }

"source has a path to E" is defined as:
If operator is AND (default): "source has a path to ALL of (A,B, ..., X, Y, ...)"
If operator is OR

RelatesToExp Field Specifications

and_op_type: AndOperatorType (INFERRED [default], SOURCE_INTERSECT, PAIR_INTERSECT)
child_expressions: RelatesToExpressions Array

AndOperatorType

INFERRED (default): Replaced with SOURCE_INTERSECT or PAIR_INTERSECT based on query execution context.
SOURCE_INTERSECT: Intersection based on source node.

Given the following graph relationship:

U1 and U2 are entity type U, and R1 and R2 are entity type R. Here U2 is in the result of U-> (P1->R AND P2->R) with SOURCE_INTERSECT. With PAIR_INTERSECT, U2 is not in the result because neither R1 or R2 matches both U->P1->R and U->P2->R.

If we change the graph to have R1 match both U->P1->R and U->P2->R:

Now U2 is in the result of the same query with PAIR_INTERSECT. PAIR_INTERSECT makes more sense for queries like “users have permission A && B to database” when the meaning is “permission A && B to the same database”

AndOperatorType defaults:

INFERRED will be replaced with one of SOURCE_INTERSECT or PAIR_INTERSECT when executing the query.
INFERRED is replaced with PAIR_INTERSECT only if:

RelatesToSpec

A RelatesToSpec represents a precise path definition:

source has a path to any node spec in node_types
- direction determines the direction of the path
the path has all required_intermediate_node_types

Field

Type

Description

RelatesToDirection can be:

ANY_DIRECTION : Direction to be chosen by the API. Paths of any direction is accepted by the caller.
SINGLE_DIRECTIONAL: Direction to be chosen by the API if there is only one valid direction. Otherwise this input is invalid.
OUTGOING: Only accept result for paths of ( -> ...). This input is invalid if there is no such a path in schema.

RiskSuppressedConstraintsCollection

define conditions on entity types to mark exceptions for queries with a risk level.

Query Builder Results

Examples and descriptions for query builder responses

Depending on the request, query results can be returned as a collection of entities (nodes), a numeric value, or a timestamp.

Requesting a query will return the result value, which can be a total number of results, the node details, or a timestamp. To return a paginated list of node details instead, use .

Sample Response: Get Nodes

List saved queries

ListAssessmentQueries retrieves a list of all built-in and user-created queries.

By default, this endpoint returns only the queries that are currently enabled. When the risks_only parameter is set to true, it will only return queries with a risk level.

Sample request

curl -X 'GET' \
"$BASE_URL/api/v1/assessments/queries?page_size=1&risks_only=true&filter=name+co+%22User%22" \
-H "authorization: Bearer $VEZA_TOKEN"

Sample response:

{
  "values": [
    {
      "id": "95ccaca3-c9f6-4711-9219-887e5c102701",
      "name": "AWS IAM Groups with iam:CreateAccessKey permission",
      "description": "AWS IAM Groups with iam:CreateAccessKey permission",
      "result_type": "NUMBER",
      "query_type": "SYSTEM_CREATED",
      "raw_permissions": {
        "values": [],
        "operator": "AND"
      },
      "effective_permissions": {
        "values": [],
        "operator": "AND"
      },
      "variables": [
        "AWS_ACCOUNT_LIST"
      ],
      "source_node_types": {
        "nodes": [
          {
            "node_type": "AwsIamGroup",
            "tags": [],
            "conditions": [],
            "condition_expression": {
              "specs": [
                {
                  "fn": "IN",
                  "property": "aws_account_id",
                  "value": [
                    "527398259632",
                    "877042069677",
                    "340069577982",
                    "241721837758",
                    "998048473876",
                    "973979857296"
                  ],
                  "not": false,
                  "value_property_name": "",
                  "value_property_from_other_node": false
                }
              ],
              "child_expressions": [],
              "operator": "AND",
              "not": false
            },
            "node_id": "",
            "excluded_tags": [],
            "count_conditions": [],
            "direct_relationship_only": false,
            "node_type_grouping_constraint": null
          }
        ],
        "nodes_operator": "AND"
      },
      "required_intermediate_node_types": {
        "nodes": [],
        "nodes_operator": "AND"
      },
      "avoided_intermediate_node_types": {
        "nodes": [],
        "nodes_operator": "AND"
      },
      "destination_node_types": {
        "nodes": [],
        "nodes_operator": "AND"
      },
      "no_relation": false,
      "access_filter": null,
      "created_by": "",
      "visibility": "PUBLIC",
      "owners": [],
      "node_relationship_type": "CONFIGURED",
      "integration_types": [
        "aws"
      ],
      "labels": [],
      "created_at": "2023-02-01T04:32:18.126875729Z",
      "updated_at": "2023-04-07T16:00:52.761867936Z",
      "source_type": "AwsIamGroup",
      "destination_types": [],
      "relates_to_exp": {
        "specs": [
          {
            "node_types": {
              "nodes": [
                {
                  "node_type": "AwsIamGroupedPermission",
                  "tags": [],
                  "conditions": [],
                  "condition_expression": {
                    "specs": [
                      {
                        "fn": "LIST_CONTAINS",
                        "property": "permissions",
                        "value": "iam:CreateAccessKey",
                        "not": false,
                        "value_property_name": "",
                        "value_property_from_other_node": false
                      },
                      {
                        "fn": "EXISTS",
                        "property": "deny",
                        "value": null,
                        "not": true,
                        "value_property_name": "",
                        "value_property_from_other_node": false
                      }
                    ],
                    "child_expressions": [],
                    "operator": "AND",
                    "not": false
                  },
                  "node_id": "",
                  "excluded_tags": [],
                  "count_conditions": [],
                  "direct_relationship_only": false,
                  "node_type_grouping_constraint": null
                }
              ],
              "nodes_operator": "AND"
            },
            "required_intermediate_node_types": null,
            "avoided_intermediate_node_types": null,
            "raw_permissions": null,
            "effective_permissions": null,
            "no_relation": false,
            "direction": "ANY_DIRECTION"
          }
        ],
        "child_expressions": [],
        "operator": "AND",
        "not": false,
        "and_op_type": "INFERRED"
      },
      "all_entity_condition": {
        "specs": [],
        "child_expressions": [],
        "operator": "AND",
        "not": false
      },
      "risk_level": "WARNING",
      "risk_suppressed_constraints": null,
      "analysis_type": "UNSET",
      "result": 0,
      "result_evaluated_at": null,
      "result_evaluated": false
    }
  ],
  "next_page_token": "eyJOZXh0Q3Vy==",
  "has_more": true
}

See Parameters for more information about the saved query object.

Save a query

CreateAssessmentQuery saves a new query with the specified conditions. See Query Parameters for all available constraints and options. To run a query without saving it, see the query spec operations.

If copying JSON query specifications from the Veza UI, change "query_type": "SYSTEM_CREATED" to "query_type": "SOURCE_TO_DESTINATION" before submitting to this API. The API only accepts SOURCE_TO_DESTINATION and DESTINATION_NODES for user-created queries.

Sample Request:

Sample response:

A successful response returns the saved query id, and full query specification in a value object:

Get a saved query

GetAssessmentQuery retrieves a single saved query object based on the query ID.

Sample request:

curl -X 'GET' \
"$BASE_URL/api/v1/assessments/queries/0827c158-9973-444c-9ca4-b941b73528c9" \
-H "authorization: Bearer $VEZA_TOKEN"

Update a query

UpdateAssessmentQuery updates an existing saved query by id, with the provided full body. Partial updates are not currently supported.

Sample request:

See create query and query parameters for more details on the saved query object.

curl -X 'GET' \
"$BASE_URL/api/v1/assessments/queries/06799e24-cd93-4509-94bc-f00b27ed5e3c" \
-H "authorization: Bearer $VEZA_TOKEN" \
-d '{"source_node_types":{"nodes":[{"node_type":"OktaUser","tags":[],"excluded_tags":[],"count_conditions":[],"direct_relationship_only":false,"node_type_grouping_constraint":null}]},"destination_node_types":{"nodes":[{"node_type":"S3Bucket","tags":[],"excluded_tags":[],"count_conditions":[],"direct_relationship_only":false,"node_type_grouping_constraint":null}]},"node_relationship_type":"EFFECTIVE_ACCESS","no_relation":false,"query_type":"SOURCE_TO_DESTINATION","raw_permissions":null,"effective_permissions":null,"include_nodes":true,"customized_variables":[],"name":"Okta User to S3","description":"updated description","labels":[],"visibility":"PRIVATE"}'

{id} (path) - string - ID of the query to modify.

Sample response:

A successful response will include the query details within a value object:

Delete a query

DeleteAssessmentQuery removes a query by ID.

By default, this operation does not delete assessments that are currently included in a report. Set the force option to true to delete an assessment regardless of its usage in reports.

Sample request:

curl -X 'DELETE' \
"$BASE_URL/api/v1/assessments/queries/c169c41c-2650-4f39-8930-f198f70f892b?force=true" \
-H "authorization: Bearer $VEZA_TOKEN"

Sample response:

A successful response will be empty:

{}

Get query node destinations

GetAssessmentQueryDestinationNodes returns details about related destination nodes for an individual result, specified by source_node_id. GetAssessmentQueryNodes returns source nodes.

To return results, the query must specify a related entity type and cannot use the no_relation option.

Sample request:

curl -X 'GET' \
"$BASE_URL/api/v1/assessments/queries/06799e24-cd93-4509-94bc-f00b27ed5e3c/destination_nodes?source_node_id=00upa6s0hSGtl1eGL5d5" \
-H "authorization: Bearer $VEZA_TOKEN"

Sample response:

{
  "values": [
    {
      "id": "arn:aws:s3:::cai-demo-bucket",
      "type": "S3Bucket",
      "properties": {
        "allows_acls": true,
        "aws_account_id": "973979857296",
        "block_public_access_enabled": true,
        "block_public_acls": true,
        "block_public_policy": true,
        "created_at": "2021-02-24T18:09:03Z",
        "datasource_id": "973979857296:s3",
        "default_encryption_enabled": true,
        "default_retention_mode": "DISABLED",
        "hosts_website": false,
        "ignore_public_acls": true,
        "name": "cai-demo-bucket",
        "object_lock_enabled": false,
        "object_ownership_controls": "ObjectWriter",
        "provider_id": "973979857296",
        "region": "us-east-2",
        "replication_rules_count": 0,
        "request_payer": "BucketOwner",
        "restrict_public_buckets": true,
        "server_access_logs_enabled": false
      },
      "destination_node_count": 0,
      "permissions": [
        {
          "id": "arn:aws:iam::973979857296:role/FederatedS3::eperm::973979857296/S3Bucket/9dab031e9731890b97dca09469ceaa68a23437b0",
          "type": "AwsIamEffectivePermission",
          "properties": {
            "aws_account_id": "973979857296",
            "datasource_id": "973979857296::eperm::973979857296:s3",
            "name": "Read,Metadata,NonData",
            "permissions": [
              "s3:GetAccelerateConfiguration",
              "s3:GetAnalyticsConfiguration",
              "s3:GetBucketAcl",
              "s3:GetBucketCORS",
              "s3:GetBucketLocation",
              "s3:GetBucketLogging",
              "s3:GetBucketNotification",
              "s3:GetBucketObjectLockConfiguration",
              "s3:GetBucketPolicy",
              "s3:GetBucketPolicyStatus",
              "s3:GetBucketPublicAccessBlock",
              "s3:GetBucketRequestPayment",
              "s3:GetBucketTagging",
              "s3:GetBucketVersioning",
              "s3:GetBucketWebsite",
              "s3:GetEncryptionConfiguration",
              "s3:GetInventoryConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetMetricsConfiguration",
              "s3:GetObject",
              "s3:GetObjectAcl",
              "s3:GetObjectLegalHold",
              "s3:GetObjectRetention",
              "s3:GetObjectTagging",
              "s3:GetObjectTorrent",
              "s3:GetObjectVersion",
              "s3:GetObjectVersionAcl",
              "s3:GetObjectVersionForReplication",
              "s3:GetObjectVersionTagging",
              "s3:GetObjectVersionTorrent",
              "s3:GetReplicationConfiguration",
              "s3:ListBucket",
              "s3:ListBucketMultipartUploads",
              "s3:ListBucketVersions",
              "s3:ListMultipartUploadParts"
            ],
            "provider_id": "973979857296"
          },
          "destination_node_count": 0,
          "permissions": [],
          "engagement_access_stats": null,
          "access_stats": null,
          "destination_node_ids": [],
          "risk_level": "NONE",
          "raw_permissions": [],
          "effective_permissions": []
        },
        {
          "id": "arn:aws:iam::973979857296:role/FederatedRedshiftAndS3::eperm::973979857296/S3Bucket/9dab031e9731890b97dca09469ceaa68a23437b0",
          "type": "AwsIamEffectivePermission",
          "properties": {
            "aws_account_id": "973979857296",
            "datasource_id": "973979857296::eperm::973979857296:s3",
            "name": "Read,Metadata,NonData",
            "permissions": [
              "s3:GetAccelerateConfiguration",
              "s3:GetAnalyticsConfiguration",
              "s3:GetBucketAcl",
              "s3:GetBucketCORS",
              "s3:GetBucketLocation",
              "s3:GetBucketLogging",
              "s3:GetBucketNotification",
              "s3:GetBucketObjectLockConfiguration",
              "s3:GetBucketPolicy",
              "s3:GetBucketPolicyStatus",
              "s3:GetBucketPublicAccessBlock",
              "s3:GetBucketRequestPayment",
              "s3:GetBucketTagging",
              "s3:GetBucketVersioning",
              "s3:GetBucketWebsite",
              "s3:GetEncryptionConfiguration",
              "s3:GetInventoryConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetMetricsConfiguration",
              "s3:GetObject",
              "s3:GetObjectAcl",
              "s3:GetObjectLegalHold",
              "s3:GetObjectRetention",
              "s3:GetObjectTagging",
              "s3:GetObjectTorrent",
              "s3:GetObjectVersion",
              "s3:GetObjectVersionAcl",
              "s3:GetObjectVersionForReplication",
              "s3:GetObjectVersionTagging",
              "s3:GetObjectVersionTorrent",
              "s3:GetReplicationConfiguration",
              "s3:ListBucket",
              "s3:ListBucketMultipartUploads",
              "s3:ListBucketVersions",
              "s3:ListMultipartUploadParts"
            ],
            "provider_id": "973979857296"
          },
          "destination_node_count": 0,
          "permissions": [],
          "engagement_access_stats": null,
          "access_stats": null,
          "destination_node_ids": [],
          "risk_level": "NONE",
          "raw_permissions": [],
          "effective_permissions": []
        }
      ],
      "engagement_access_stats": null,
      "access_stats": null,
      "destination_node_ids": [],
      "risk_level": "NONE",
      "raw_permissions": [
        "s3:GetAccelerateConfiguration",
        "s3:GetAnalyticsConfiguration",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketNotification",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetMetricsConfiguration",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectTagging",
        "s3:GetObjectTorrent",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectVersionTorrent",
        "s3:GetReplicationConfiguration",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions",
        "s3:ListMultipartUploadParts"
      ],
      "effective_permissions": [
        "Metadata",
        "NonData",
        "Read"
      ]
    }
  ],
  "path_values": [],
  "next_page_token": "",
  "has_more": false
}

Get query nodes

GetAssessmentQueryNodes returns node details for entities in the query results, with a paginated response.

Please note that the total number of the results is not provided . To get a result count, use GetAssessmentQueryResult.

Sample request:

curl -X 'GET' "$BASE_URL/api/v1/assessments/queries/06799e24-cd93-4509-94bc-f00b27ed5e3c:nodes" \
-H "authorization: Bearer $VEZA_TOKEN"

Sample response:

{
  "values": [
    {
      "id": "arn:aws:iam::877042069677:user/j.smith",
      "type": "AwsIamUser",
      "properties": {
        "aws_account_id": "877042069677",
        "datasource_id": "877042069677:awsiam",
        "name": "j.smith",
        "provider_id": "877042069677"
      },
      "destination_node_count": 1,
      "permissions": [],
      "engagement_access_stats": null,
      "access_stats": null,
      "destination_node_ids": [],
      "risk_level": "CRITICAL",
      "raw_permissions": [],
      "effective_permissions": []
    },
    {
      "id": "arn:aws:iam::877042069677:user/jsmith-lab-01",
      "type": "AwsIamUser",
      "properties": {
        "aws_account_id": "877042069677",
        "datasource_id": "877042069677:awsiam",
        "name": "jsmith-lab-01",
        "provider_id": "877042069677"
      },
      "destination_node_count": 1,
      "permissions": [],
      "engagement_access_stats": null,
      "access_stats": null,
      "destination_node_ids": [],
      "risk_level": "CRITICAL",
      "raw_permissions": [],
      "effective_permissions": []
    }
  ],
  "path_values": [],
  "next_page_token": "",
  "has_more": false
}

Get query result

GetAssessmentQueryResult returns the total number of results for a saved query.

To get node details for the source entity type, use GetAssessmentQueryNodes. To get related destination nodes for an individual result, use GetAssessmentQueryDestinationNodes.

Sample request:

curl -X 'GET' "$BASE_URL/api/v1/assessments/queries/6288f9ac-ff58-49b1-87a0-79ae7572448f:result" \
-H "authorization: Bearer $VEZA_TOKEN"

Sample Response:

The response will include a number_value representing the total number of results.

{
    "result_type": "number",
    "number_value": "6"
}

Get query spec node destinations

GetAssessmentQuerySpecDestinationNodes returns the related destination nodes, including effective permissions, for a single entity in the results of a saved query.

Sample request:

The request must include the full query spec object, and the source_node_id of the query result to return destination nodes for. You can additionally provide a snapshot_id to query against historical data.

curl -X 'POST' "$BASE_URL/api/v1/assessments/query_spec:destination_nodes?page_size=0&page_token=" \
-H "authorization: Bearer $VEZA_TOKEN" \
-d '{
  "spec": {
    "query_type": "SOURCE_TO_DESTINATION",
    "include_nodes": true,
    "source_node_types": {
      "nodes": [
        {
          "node_type": "AwsIamUser"
        }
      ]
    },
    "destination_node_types": {
      "nodes": [
        {
          "node_type": "S3Bucket"
        }
      ]
    },
    "no_relation": false,
    "raw_permissions": {
      "operator": "OR",
      "values": [
        "s3:PutBucketAcl"
      ]
    }
  },
  "source_node_id": "arn:aws:iam::877042069677:user/j.smith",
  "snapshot_id": "1690182000"
}'

Sample response:

{
  "values": [
    {
      "id": "arn:aws:s3:::aws-cloudtrail-logs-877042069677-a35f269d",
      "type": "S3Bucket",
      "properties": {
        "allows_acls": true,
        "aws_account_id": "877042069677",
        "block_public_access_enabled": true,
        "block_public_acls": true,
        "block_public_policy": true,
        "created_at": "2022-02-07T20:33:19Z",
        "datasource_id": "877042069677:s3",
        "default_encryption_enabled": true,
        "default_retention_mode": "DISABLED",
        "hosts_website": false,
        "ignore_public_acls": true,
        "name": "aws-cloudtrail-logs-877042069677-a35f269d",
        "object_lock_enabled": false,
        "object_ownership_controls": "ObjectWriter",
        "provider_id": "877042069677",
        "region": "us-east-1",
        "replication_rules_count": 0,
        "request_payer": "BucketOwner",
        "restrict_public_buckets": true,
        "server_access_logs_enabled": false
      },
      "destination_node_count": 0,
      "permissions": [
        {
          "id": "arn:aws:iam::877042069677:user/j.smith::eperm::877042069677/S3Bucket/9e5c59f46ddc58231c08bc23534d1a83c0bffe87",
          "type": "AwsIamEffectivePermission",
          "properties": {
            "aws_account_id": "877042069677",
            "datasource_id": "877042069677::eperm::877042069677:s3",
            "name": "Create,Write,Delete,Read,Metadata,NonData",
            "permissions": [
              "s3:AbortMultipartUpload",
              "s3:BypassGovernanceRetention",
              "s3:DeleteBucket",
              "s3:DeleteBucketPolicy",
              "s3:DeleteBucketWebsite",
              "s3:DeleteObject",
              "s3:DeleteObjectTagging",
              "s3:DeleteObjectVersion",
              "s3:DeleteObjectVersionTagging",
              "s3:GetAccelerateConfiguration",
              "s3:GetAnalyticsConfiguration",
              "s3:GetBucketAcl",
              "s3:GetBucketCORS",
              "s3:GetBucketLocation",
              "s3:GetBucketLogging",
              "s3:GetBucketNotification",
              "s3:GetBucketObjectLockConfiguration",
              "s3:GetBucketPolicy",
              "s3:GetBucketPolicyStatus",
              "s3:GetBucketPublicAccessBlock",
              "s3:GetBucketRequestPayment",
              "s3:GetBucketTagging",
              "s3:GetBucketVersioning",
              "s3:GetBucketWebsite",
              "s3:GetEncryptionConfiguration",
              "s3:GetInventoryConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetMetricsConfiguration",
              "s3:GetObject",
              "s3:GetObjectAcl",
              "s3:GetObjectLegalHold",
              "s3:GetObjectRetention",
              "s3:GetObjectTagging",
              "s3:GetObjectTorrent",
              "s3:GetObjectVersion",
              "s3:GetObjectVersionAcl",
              "s3:GetObjectVersionForReplication",
              "s3:GetObjectVersionTagging",
              "s3:GetObjectVersionTorrent",
              "s3:GetReplicationConfiguration",
              "s3:ListBucket",
              "s3:ListBucketMultipartUploads",
              "s3:ListBucketVersions",
              "s3:ListMultipartUploadParts",
              "s3:ObjectOwnerOverrideToBucketOwner",
              "s3:PutAccelerateConfiguration",
              "s3:PutAnalyticsConfiguration",
              "s3:PutBucketAcl",
              "s3:PutBucketCORS",
              "s3:PutBucketLogging",
              "s3:PutBucketNotification",
              "s3:PutBucketObjectLockConfiguration",
              "s3:PutBucketPolicy",
              "s3:PutBucketPublicAccessBlock",
              "s3:PutBucketRequestPayment",
              "s3:PutBucketTagging",
              "s3:PutBucketVersioning",
              "s3:PutBucketWebsite",
              "s3:PutEncryptionConfiguration",
              "s3:PutInventoryConfiguration",
              "s3:PutLifecycleConfiguration",
              "s3:PutMetricsConfiguration",
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:PutObjectLegalHold",
              "s3:PutObjectRetention",
              "s3:PutObjectTagging",
              "s3:PutObjectVersionAcl",
              "s3:PutObjectVersionTagging",
              "s3:ReplicateDelete",
              "s3:ReplicateObject",
              "s3:ReplicateTags",
              "s3:RestoreObject"
            ],
            "provider_id": "877042069677"
          },
          "destination_node_count": 0,
          "permissions": [],
          "engagement_access_stats": null,
          "access_stats": null,
          "destination_node_ids": [],
          "risk_level": "NONE",
          "raw_permissions": [],
          "effective_permissions": []
        }
      ],
      "engagement_access_stats": null,
      "access_stats": null,
      "destination_node_ids": [],
      "risk_level": "NONE",
      "raw_permissions": [
        "s3:AbortMultipartUpload",
        "s3:BypassGovernanceRetention",
        "s3:DeleteBucket",
        "s3:DeleteBucketPolicy",
        "s3:DeleteBucketWebsite",
        "s3:DeleteObject",
        "s3:DeleteObjectTagging",
        "s3:DeleteObjectVersion",
        "s3:DeleteObjectVersionTagging",
        "s3:GetAccelerateConfiguration",
        "s3:GetAnalyticsConfiguration",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketNotification",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetMetricsConfiguration",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectTagging",
        "s3:GetObjectTorrent",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectVersionTorrent",
        "s3:GetReplicationConfiguration",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions",
        "s3:ListMultipartUploadParts",
        "s3:ObjectOwnerOverrideToBucketOwner",
        "s3:PutAccelerateConfiguration",
        "s3:PutAnalyticsConfiguration",
        "s3:PutBucketAcl",
        "s3:PutBucketCORS",
        "s3:PutBucketLogging",
        "s3:PutBucketNotification",
        "s3:PutBucketObjectLockConfiguration",
        "s3:PutBucketPolicy",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutBucketRequestPayment",
        "s3:PutBucketTagging",
        "s3:PutBucketVersioning",
        "s3:PutBucketWebsite",
        "s3:PutEncryptionConfiguration",
        "s3:PutInventoryConfiguration",
        "s3:PutLifecycleConfiguration",
        "s3:PutMetricsConfiguration",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:PutObjectTagging",
        "s3:PutObjectVersionAcl",
        "s3:PutObjectVersionTagging",
        "s3:ReplicateDelete",
        "s3:ReplicateObject",
        "s3:ReplicateTags",
        "s3:RestoreObject"
      ],
      "effective_permissions": [
        "Create",
        "Delete",
        "Metadata",
        "NonData",
        "Read",
        "Write"
      ]
    }
  ],
  "path_values": [],
  "next_page_token": "",
  "has_more": false
}

Get query spec nodes

GetAssessmentQuerySpecNodes returns the entity details for nodes in the query without generating a result count. This option uses pagination and can be faster for complex queries where the total number of search results is not needed.

The request must include the full query spec object and the source_node_id of the query result to retrieve destination nodes for. Additionally, providing a snapshot_id will return destination nodes based on a Time Machine snapshot.

When specifying a page_size in the query string, responses will include the next_page_token and indicate has_more if additional results are available. Note that a page can be empty even when more results exist.

Sample request:

Get query spec results

GetAssessmentQuerySpecResult Returns the total count of results for a query specification.

The response will include a number_value representing the total number of results.

Sample request:

Sample response:

The response will contain a number_value of total results:

Private APIs

Documentation for Veza's private APIs for advanced access assessments

Overview

This section contains documentation for APIs in the private/ namespace for advanced access assessment capabilities. These APIs currently support advanced role analysis, entitlement comparisons, and access management for Snowflake environments.

Available APIs

Get Access Relationship

Identify grantees (such as roles) providing specific access permissions to a given identity for a set of resources.

Early Access: This API is provided in Early Access. Please contact our customer support team for more information and to enable this feature.

Overview

The GetAccessRelationship API takes an identity (user), a list of resources with permissions, and responds with potential grantees (roles) that can grant these access permissions to the user. The response includes detailed information about the additional access these grantees would provide. This API is particularly designed for role recommendations and permissions analysis in Snowflake environments.

Use cases and features

This API returns potential grantees (i.e., Snowflake roles) that can provide specific permissions, with results ordered by the level of "extra access" they provide (access not already available to the user). The response includes comparisons between current access and potential access and supports filtering by grantee type and other criteria.

Role Recommendations: Find the most appropriate roles to grant a user for specific access needs
Privilege Analysis: Analyze what additional privileges different roles would provide to a user
Access Management: Compare different access options before making permission changes
Least Privilege Implementation

Limitations

This feature is currently limited to the .
For highly connected identities (>10,000 accesses or accessible resources), the calculation of "extra access" can be performance-intensive. For a timely response, the API will return grantees with the least resources by themselves, instead of those providing the least extra resources. In such cases, is_identity_highly_connected will be set to true in response.

Get Access Relationship

Request Parameters

The API accepts a GetAccessRelationshipRequest object with the following parameters:

Parameter

Type

Required

Description

Important: Either resource_permissions or the combination of (resource_id, resource_type, raw_permissions, effective_permissions) must be provided in the request, but not both.

Result Ordering

The API provides two options for ordering the returned grantees:

Default Order (Minimal Access Count): By default, the API returns grantees ordered by their access count, prioritizing roles with fewest total accesses.
Least Privileged: When setting "result_order": "LEAST_PRIVILEGED", the API orders grantees by least privilege principle (minimum necessary permissions) and enables several advanced features:
- No system-defined admin roles will be returned in the results

Special Considerations

When max_resource_count is reached for an identity, the API will return grantees with the least resources by themselves, instead of those providing the least extra resources.
The no_extra_stats parameter improves performance when detailed statistics aren't needed. This parameter will:
- Skip saved query lookup for grantee IDs

Response Structure

The API returns a GetAccessRelationshipResponse object with the following fields:

Field

Type

Description

Note: There are deprecated fields in the response (role_id, resource_type, new_accessible_resource_count) that should not be used. Use the ordered_node_access_changes field instead.

NodeAccessChange Structure

Each NodeAccessChange object contains:

Field

Type

Description

ResourceAccessChange Structure

Each ResourceAccessChange object contains:

Field

Type

Description

Usage Examples

Example 1: Using Resource Permissions (Recommended)

This example shows how to use the API to find roles that would give a specific Snowflake user access to certain resources using the resource_permissions parameter.

Request

Example 2: Using Resource ID and Permissions

This example shows how to use the API with the resource ID and permissions approach.

This example uses LEAST_PRIVILEGED result ordering. The response will prioritize grantees that provide the minimum necessary permissions to meet the requested access requirements.

Request

Response

Cohort Role Analysis

Analyze roles accessible to Snowflake users within a specified cost center.

Early Access: This API is provided in Early Access. Please contact our customer support team for more information and to enable this feature.

Overview

The Cohort Role Analysis API provides insights into role accessibility for Snowflake users within a specified cost center. It identifies which roles are accessible to users in that cost center and orders them by least privilege, helping to establish common access patterns and standardize role assignments. The response includes:

A list of roles accessible to users in the cost center
An indication of whether these roles are accessible to all users or only some users in the cost center

The API first attempts to find roles that are accessible to all principals (users) in the cost center. If no roles are accessible to all principals, it falls back to returning roles that are accessible by at least one principal, indicated by the accessibility_type field in the response.

Use cases and features

This API can help organizations understand common access patterns within organizational units and can support role standardization efforts:

Role Standardization: Identify common roles used within organizational units
Access Pattern Analysis: Discover shared access patterns among users in the same cost center
Least Privilege Implementation: Find roles that provide necessary access with minimal permissions
Onboarding Planning: Determine appropriate roles for new hires based on their cost center

Limitations

This feature is currently limited to the .
Role analysis is based on cost center information, which must be properly configured in your system.

Cohort Role Analysis API

Request Parameters

The API accepts a request object with the following parameters:

Parameter

Type

Required

Description

Protocol Definition

Proto Message Definitions

The API uses the following protocol buffer message definitions:

Response Structure

The API returns a response object with the following fields:

Field

Type

Description

Accessibility Types

The accessibility_type field can have one of the following values:

Value

Description

Note: If no roles are accessible to all principals in the cost center, the API falls back to returning roles accessible by any principal, and the accessibility_type will be set to ANY_PRINCIPAL.

Usage Example

Example 1: Roles Accessible to All Principals

Request

Response

The response indicates these roles are accessible to all users in the cost center:

Example 2: Roles Accessible to Any Principal

Request

Response

The response indicates no roles are accessible to all users, but these roles are accessible to at least one user in the cost center:

Create, Add, Remove Tag

Create, apply, and remove Veza tags

New in 2022.3.2: Tagging operations are now available as part of the v1/ API set.

Methods

Create Veza Tag

Post {VezaURL}/api/v1/graph/tags

Define a new tag that can be applied to any discovered entity, as a key:value pair. The tag value is optional.

Parameter

Description

A successful response will be empty ({}).

Add Veza Tag

Post {VezaURL}/api/v1/graph/nodes/tags

Apply one or more tags to an entity by providing an entity ID. A new Tag will be created if one doesn't already exist.

Parameter

Description

To retrieve an entity ID, you can use the Query Builder API, or browse the Identity Data Entities catalog.

Remove Veza Tag

Post {VezaURL}/api/v1/graph/nodes/tags:remove

Remove a tag from an entity.

Parameter

Description

A successful response will be empty ({}).

Promoted Tags

Operations for adding, removing, and listing tags for entity enrichment.

Tag promotion for Access Reviews is currently available in Early Access. Please contact our support team to enable this capability.

Use these APIs to define the tags Veza should treat as customer-defined properties. Access Reviews that involve these entity types will include columns showing the tag name and value.

For example, in AWS, you may automatically tag identities with a 3rd-party security tool, or use tags to label S3 buckets containing sensitive data. When a tag is promoted, Veza Access Reviews will treat the tag as a built-in entity attribute, and show this information for reviewers in an optional column.

Query Builder Parameters

Options for saved and spec query requests

Query parameters

Field

Type

Notes

NodeSpecCollection

A collection of node specifications, defining constraints or other query parameters on each entity type.

You can query for a single principal or resource by filtering on node ID.

Field

Type

Notes

NodeSpec

Contains the type, tags, and conditions applied to a node, narrowing the focus of the query.

Note that you can add conditions and tags to either the source node type or the destination.

Field

Type

Notes

NodeTypeGroupingConstraint

ConditionExpression

Conditions can always apply to source and destination node types. Conditions can only apply to intermediate node types when the query defines required_intermediate_node_types.

Conditions have a function (fn). Valid operators are:

EQ: 'Equals',
LT: 'Less Than',
LTE: 'Less Than or Equal',

Date-based operators can be:

LT: 'Not in the Last', LTE: 'Before', GT: 'In the Last', GTE: 'After', EQ: 'At',

For example:

The condition value can be true, false, a number, an RFC3339 timestamp, or a string. For example, to find S3 Bucket destinations where public ACLs haven't been blocked:

Conditions can also contain a string-typed value. For example, to find all Okta users with the prefix "sa-":

Note that you can specify nodes where the condition doesn't apply by setting "not": true for the constraint.

There can also be a not on the whole expression:

You can get all the properties available for different node types (which vary depending on the provider and service) by searching for the entities in Authorization Graph and viewing the node details.

No relation

Enable no_relation to only return nodes without a relationship to the destination node types. For example, to show Microsoft Azure AD users that do not belong to the group "Alabama":

Avoids intermediate node types

To query for relationships that do not include a specific node type in the authorization path, specify an exclusion in the avoids_intermediate_node_types object:

Query type

Query Type

Description

Permissions

To return only entities with one or more permissions to a resource, you can list either system or effective permissions, with an AND or OR operator.

RawPermissionCollection

"Raw" or "System" permissions describe privileges using the service providers terms, for example s3:PutBucketAcl.

Field

Type

Notes

You can review all the possible permissions Veza has discovered for an entity by selecting it as a related entity in a Query Builder search. The "Permissions" dropdown menu will include all effective and raw permissions for the resource type.

EffectivePermissionCollection

Field

Type

Notes

RelatesToExp

RelatesToExp Evaluation

For E = { specs: [A, B, ...], child_expressions: [X, Y, ...], operator, not }

"source has a path to E" is defined as:
If operator is AND (default): "source has a path to ALL of (A,B, ..., X, Y, ...)"
If operator is OR

RelatesToExp Field Specifications

and_op_type: AndOperatorType (INFERRED [default], SOURCE_INTERSECT, PAIR_INTERSECT)
child_expressions: RelatesToExpressions Array

AndOperatorType

INFERRED (default): Replaced with SOURCE_INTERSECT or PAIR_INTERSECT based on query execution context.
SOURCE_INTERSECT: Intersection based on source node.

Given the following graph relationship:

If we change the graph to have R1 match both U->P1->R and U->P2->R:

AndOperatorType defaults:

INFERRED will be replaced with one of SOURCE_INTERSECT or PAIR_INTERSECT when executing the query.
INFERRED is replaced with PAIR_INTERSECT only if:

RelatesToSpec

A RelatesToSpec represents a precise path definition:

source has a path to any node spec in node_types
- direction determines the direction of the path
the path has all required_intermediate_node_types

Field

Type

Description

RelatesToDirection can be:

ANY_DIRECTION : Direction to be chosen by the API. Paths of any direction is accepted by the caller.
SINGLE_DIRECTIONAL: Direction to be chosen by the API if there is only one valid direction. Otherwise this input is invalid.
OUTGOING: Only accept result for paths of ( -> ...). This input is invalid if there is no such a path in schema.

RiskSuppressedConstraintsCollection

define conditions on entity types to mark exceptions for queries with a risk level.

Query APIs

Base URL

Authentication

Getting started

Quick Start

Authentication

Query specifications

Get destination nodes

Save a query

Get saved query result count or entity details

Query Builder Terminology

Entity (Node)

Entity Attribute

Entity Type

Entity Type Grouping

Effective and System Permissions

Tags

Query Builder Parameters

Query parameters

NodeSpecCollection

NodeSpec

NodeTypeGroupingConstraint

ConditionExpression

Tags

No relation

Avoids intermediate node types

Query type

Permissions

RawPermissionCollection

EffectivePermissionCollection

RelatesToExp

RelatesToExp Evaluation

RelatesToExp Field Specifications

AndOperatorType

RelatesToSpec

RiskSuppressedConstraintsCollection

Query Builder Results

Sample Response: Get Nodes

List saved queries

Save a query

Get a saved query

Update a query

Delete a query

Get query node destinations

Get query nodes

Get query result

Get query spec node destinations

Get query spec nodes

Get query spec results

Private APIs

Overview

Available APIs

Get Access Relationship

Overview

Use cases and features

Limitations

Get Access Relationship

Request Parameters

Result Ordering

Special Considerations

Response Structure

NodeAccessChange Structure

ResourceAccessChange Structure

Usage Examples

Example 1: Using Resource Permissions (Recommended)

Example 2: Using Resource ID and Permissions

Response

Related APIs

Cohort Role Analysis

Overview

Use cases and features

Limitations

Cohort Role Analysis API

Request Parameters

Protocol Definition

Proto Message Definitions

Response Structure

Accessibility Types

Usage Example

Example 1: Roles Accessible to All Principals