Get workflow details

kind string

Possible values: [workflow, workflow_with_configuration]

Discriminator for the GET /workflows/{id} response variant. workflow is returned when include_configuration=false; workflow_with_configuration when the latest version is bundled into the response. The enum lists both values intentionally so the schema composition WorkflowWithConfiguration = allOf [Workflow, WorkflowConfiguration] doesn't produce an unsatisfiable enum constraint; the discriminator on the endpoint's oneOf does the runtime dispatch. Required so the typescript-fetch generator emits switch-based dispatch (needed since openapi-generator-cli v7 — see PR #5928) instead of order-sensitive instanceOf checks that silently drop the configuration fields when both schemas overlap.

id string

Unique workflow identifier

org_id string

Organization ID

name string

Possible values: non-empty and <= 255 characters

Workflow name

description string

Possible values: <= 1000 characters

Workflow description

lifecycle string

Possible values: [joiner, mover, leaver, risk_signal]

Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

status string

Possible values: [draft, active, paused, deleted]

Current state of a workflow

created_by string

User ID who created the workflow

created_at date-time

Workflow creation timestamp

updated_by string

User ID who last updated the workflow

updated_at date-time

Last update timestamp

activated_at date-time

When workflow was first activated

paused_at date-time

When workflow was paused

paused_by string

User ID who paused the workflow. Set when the workflow is paused, cleared on resume.

last_executed_at date-time

Last execution timestamp

execution_count integer

Total execution count

success_count integer

Successful execution count

failure_count integer

Failed execution count

latest_configuration_id string

ID of the latest configuration version

latest_configuration_version integer

Latest configuration version number

workflow_id string

Parent workflow ID

version integer

Possible values: >= 1

Configuration version number

data_input_config object

oneOf

MOD1
MOD2
MOD3
MOD4

type string

Possible values: [detection]

Data input type discriminator

scim_filter string

Possible values: non-empty

SCIM filter string to apply when querying detections. Examples:

severity eq "critical"
type eq "aws_identity_unused" and status eq "detected"
entity_type eq "aws_iam_user"
severity eq "critical" or severity eq "high"

include_suppressed boolean

Default value: false

By default the input only returns active detections that no detection rule suppressed: the filter is narrowed with not (suppressed_by_rule_id pr) and, when it does not mention status, to the active statuses. Set to true to pass scim_filter through untouched.

limit integer

Possible values: <= 10000

Maximum number of detections to retrieve (0 for no limit)

sorting object[]

Sorting configuration for results

field string

Field to sort by

direction string

Possible values: [asc, desc]

Default value: desc

Sort direction

type string

Possible values: [lifecycle]

Data input type discriminator

event_types string[]

Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold], >= 1

Lifecycle events that trigger this workflow

entity_types string[]

Filter by entity types (e.g., aws_iam_user, entra_user). If empty, all entity types are matched.

source_types string[]

Filter by identity source types (e.g., aws_account, entra). If empty, all source types are matched.

connection_ids string[]

Filter by specific connection IDs. If empty, all connections are matched.

min_risk_score integer

Possible values: <= 100

Only trigger for entities with risk score >= this value

max_risk_score integer

Possible values: <= 100

Only trigger for entities with risk score <= this value

include_relationships boolean

Default value: false

Fetch manager, groups, direct reports from Neo4j

include_permissions boolean

Default value: false

Fetch permission assignments from Neo4j

include_access_history boolean

Default value: false

Fetch recent access records from Neo4j

relationship_depth integer

Possible values: <= 3

Default value: 1

How deep to traverse relationships in Neo4j (default 1, max 3)

scim_filter string

Additional SCIM-style filter criteria for the entity

attribute_filters object[]

Conditions on the triggering identity's raw source attributes, evaluated against data.attributes.*. Populated by JML compilation from JMLSource.trigger.filters — deliberately NOT compiled into scim_filter above, whose grammar cannot express a data.attributes.<key> path. Can also be set directly on a raw (non-JML) lifecycle data input.

attr string

Attribute key to compare, e.g. "employee_type". The reserved key "group" matches on the identity's group memberships (the graph's IS_MEMBER_OF edge) instead of a raw attribute: the value is a group name, and eq also accepts the group's entity_id. A filter holds when any group satisfies it; ne holds when none equals it.

op string

Possible values: [eq, ne, co, sw, ew, pr]

Comparison operator (equals, not-equals, contains, starts-with, ends-with, present).

value

type string

Possible values: [uar_finding]

Data input type discriminator

triggers string[]

UarFindingV1 trigger reasons that fire this workflow (ANY match). Defaults to ["manual"] when empty.

campaign_ids uuid[]

Filter by specific campaign IDs. Empty matches all.

campaign_template_ids uuid[]

Filter by campaign template IDs. Empty matches all.

campaign_types string[]

Filter by campaign type (e.g. user, resource, non_human_identity). Empty matches all.

classification_tags string[]

Filter by classification tags on the finding. Empty matches all.

outcomes string[]

Filter by reviewer decision outcome (e.g. approve, revoke). Empty matches all.

only_effective boolean

Default value: false

Match only when effective_outcome == outcome — the decision survived multi-tier escalation rather than being overridden.

min_level integer

Filter by decision level >= this value.

only_high_privilege boolean

Default value: false

Restrict to findings flagged as high-privilege.

user_source_types string[]

Filter by user identity source type. Empty matches all.

user_entity_types string[]

Filter by user entity type. Empty matches all.

asset_source_types string[]

Filter by asset source type. Empty matches all.

asset_entity_types string[]

Filter by asset entity type. Empty matches all.

granting_entity_types string[]

Filter by granting entity type (e.g. role, group). Empty matches all.

scim_filter string

Optional SCIM-style filter over the flattened finding payload, applied after the structured filters above.

type string

Possible values: [cypher_query]

Data input type discriminator

query string

Possible values: non-empty and <= 10000 characters

Read-only Cypher query whose rows feed downstream workflow actions. Must contain MATCH and RETURN clauses. Write operations and the USE clause are rejected by the validator. Comments and strings are tokenized before validation, so a write keyword inside a string literal is allowed.

parameters object

Parameters bound into the query at execution time. Keys must match the $name placeholders in query. Values are passed verbatim to the Neo4j driver.

max_rows integer

Possible values: >= 1 and <= 10000

Default value: 1000

Maximum rows returned by a scheduled execution (NOT the preview). Capped server-side at 10000.

timeout_seconds integer

Possible values: >= 1 and <= 300

Default value: 30

Per-execution query timeout (NOT the preview). Capped server-side at 300.

on_limit_exceeded string

Possible values: [fail, truncate]

Default value: fail

Behavior when the query returns more than max_rows. fail aborts the execution with an error; truncate returns the first max_rows rows and marks the execution as truncated.

primary_entity_column string

Optional. Name of a query result column whose value is the primary entity ID for each row. When set, downstream remediation actions can target this entity. Must match one of the column aliases in the query's RETURN clause.

name string

Possible values: <= 128 characters, Value must match regular expression ^[A-Za-z0-9][A-Za-z0-9 _.:-]*$

Name of the custom detection the rows become. The emitted detections carry the type custom:<name>; when omitted they carry custom_cypher_detection.

severity string

Possible values: [critical, high, medium, low]

Default value: medium

Severity of the emitted detections.

category string

Default value: custom

Category of the emitted detections: custom, or the name of a registered detection category or subcategory.

actions object

Actions configuration. Map of action ID to action configuration.

discriminator

Possible values: [remediation, ticket, data_sink, webhook, notification, condition, access_review]

oneOf

starting_actions string[]

IDs of actions to execute first (after data input).

schedule string

Optional cron expression (5-field, UTC). When non-empty, the workflow is registered with the scheduler and fires on each tick (cron parser: github.com/hashicorp/cronexpr). Must be empty when data_input_config.type is lifecycle — lifecycle workflows are event-driven and cannot be scheduled.

authoring_model string

Possible values: [raw, jml]

Discriminates how this configuration was authored. "raw" (default) means data_input_config/actions/starting_actions were authored directly. "jml" means jml_source is the source of truth and those three fields are compiled output: they are derived from jml_source on every write and a request that supplies them directly alongside authoring_model=jml is rejected with 400.

NOTE: this is a different discriminator from kind on the Workflow/WorkflowWithConfiguration response — kind is a response-variant discriminator (workflow vs workflow_with_configuration) used by the generated client to dispatch a oneOf, and has nothing to do with JML. Dispatch the JML editor vs the raw DAG editor on authoring_model, not kind.

jml_source object

lifecycle string

Possible values: [joiner, mover, leaver, risk_signal]

Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

trigger object

Exactly one of event or events must be set. events is the current form — the UI's "Someone joins" chip compiles to [created, reactivated]; event is kept for existing sources and is treated as a one-element events.

event string

Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold]

Type of user lifecycle event that triggers the workflow. Phase 1 (Core): created, deleted, suspended Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

events string[]

Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold], >= 1

The lifecycle events that fire this workflow. Any one of them arriving from a source connection starts a run.

source_connections string[]

Possible values: >= 1

filters object[]

attr string

Attribute key to compare, e.g. "employee_type". The reserved key "group" matches on the identity's group memberships (the graph's IS_MEMBER_OF edge) instead of a raw attribute: the value is a group name, and eq also accepts the group's entity_id. A filter holds when any group satisfies it; ne holds when none equals it.

op string

Possible values: [eq, ne, co, sw, ew, pr]

Comparison operator (equals, not-equals, contains, starts-with, ends-with, present).

value

phases object

The three fixed phases. The boundary is load-bearing: the Mover/Leaver access diff is computed over access only.

before object[]

type string

Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

id string

Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

name string

Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

connection string

Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

granting_type string

Used by grant, revoke — e.g. "okta_group".

granting_id string

Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

granting_id_ref object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

subject object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

role_id string

Used by role. The JMLRole whose entitlements are granted.

target string

Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

channel string

Used by notify — e.g. "email", "slack".

to string

Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

provider string

Used by ticket — e.g. "jira", "servicenow".

params object

Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

enabled boolean

Default value: true

When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

access object[]

Only grant and role steps contribute here; access is folded into one access_policy node at compile time.

type string

Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

id string

Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

name string

Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

connection string

Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

granting_type string

Used by grant, revoke — e.g. "okta_group".

granting_id string

Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

granting_id_ref object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

subject object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

role_id string

Used by role. The JMLRole whose entitlements are granted.

target string

Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

channel string

Used by notify — e.g. "email", "slack".

to string

Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

provider string

Used by ticket — e.g. "jira", "servicenow".

params object

Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

enabled boolean

Default value: true

When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

after object[]

type string

Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

id string

Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

name string

Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

connection string

Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

granting_type string

Used by grant, revoke — e.g. "okta_group".

granting_id string

Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

granting_id_ref object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

subject object

A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

from_step string

The id of an earlier step in the policy's chain.

output string

The name of an output that step declares.

from_trigger string

A value of the triggering identity, e.g. "email" or "attributes.department".

role_id string

Used by role. The JMLRole whose entitlements are granted.

target string

Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

channel string

Used by notify — e.g. "email", "slack".

to string

Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

provider string

Used by ticket — e.g. "jira", "servicenow".

params object

Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

enabled boolean

Default value: true

When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

is_latest boolean

Whether this is the latest version

Get workflow details​