Skip to main content

Get a workflow execution​

Retrieve a single execution — the dry-run verdict a manual trigger's caller polls for. 404 if the execution does not exist, or exists but belongs to a different workflow or organization.

Path Parameters
  • workflow_id string required

    Workflow identifier

  • execution_id string required

    Execution identifier

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

Workflow execution details

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object
  • id uuid

    Unique execution ID

  • workflow_id uuid

    ID of the workflow being executed

  • org_id uuid

    Organization ID

  • configuration_id uuid

    ID of the configuration version used for this execution

  • status string

    Possible values: [running, completed, failed]

    Overall status of a workflow execution

  • started_at date-time

    When the execution started

  • completed_at date-time

    When the execution completed

  • error string

    Error message if execution failed

  • mode string

    Possible values: [live, dry_run]

    Controls whether an execution publishes outbound provider events. dry_run resolves and records every step identically to a live run but suppresses outbound publication at the publish boundary. Empty (on an existing execution) means live.

  • planned_actions object[]

    The dry-run verdict: what each resolved step would have done. Resolved entries are populated only for dry_run executions; unresolved entries (steps that could not be dispatched) are recorded for live executions too, so a skipped step is visible rather than indistinguishable from success.

  • action_id string

    The workflow action node ID, e.g. "access-policy", "before-0".

  • action_type string

    The node's action type, e.g. "remediation", "notification", "access_policy".

  • resolved_payload_type string

    Go type name identifying what would have been published, e.g. "*ip_events.ActionRequestedV1_AwsCreateUserAndRole". Empty when resolved is false.

  • target_provider string

    Populated only for message types that carry a target provider (remediation and access_policy grant/revoke); empty otherwise.

  • target_identifier string

    Populated only for message types that carry a target identifier (remediation and access_policy grant/revoke); empty otherwise.

  • resolved boolean
  • error string

    Resolution failure reason when resolved is false. Covers both Accept-level failures (e.g. a remediation recipe missing a required parameter, dry run only) and access_policy grant/revoke targets with no matching recipe — the latter are skipped rather than dispatched and recorded here in live executions as well.

  • bindings object[]

    Which of this step's values were references (from_step / from_trigger) that this DRY RUN could only stand in for: no executor ran, so no earlier step produced a real output, and each one resolved to a visible placeholder (<create-aws.role_arn>) instead. Absent on a live entry, and on a dry-run entry whose references all resolved to real values — a dry run retried against an execution whose earlier steps did run reads their persisted outputs.

  • param string

    The binding site: the parameter's own name, granting_id for a granting_id_ref, or subject for the identity the step acts on (which fills no parameter).

  • from_step string

    The id of the earlier step whose output fills this value.

  • output string

    The name of that step's declared output.

  • from_trigger string

    A key of the triggering identity's vocabulary — identifier, display_name, email, source_identifier, or attributes.<key> — set instead of from_step/output.

  • data_input_execution object
  • status string

    Possible values: [pending, running, succeeded, failed, skipped]

    Overall status of an action node's execution

  • started_at date-time

    When data input retrieval started

  • completed_at date-time

    When data input retrieval completed

  • error string

    Error message if data input failed

  • input_count integer

    Total number of data items retrieved

  • filtered_count integer

    Number of data items that passed the filter

  • action_executions object

    Map of action ID to execution state

  • property name* object
  • trigger object
  • kind string

    Possible values: [lifecycle_event, manual, retry]

    What started this execution. lifecycle_event carries event_type and (when the event's subject resolved to a graph entity) subject; manual and retry carry neither. Dry-run is orthogonal — see the execution's mode.

  • event_type string

    Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold]

    Type of user lifecycle event that triggers the workflow. Phase 1 (Core): created, deleted, suspended Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

  • subject object

    The identity the triggering lifecycle event was about, snapshotted at execution creation so the run stays attributable after the entity changes or is deleted.

  • entity_id string

    Graph entity ID of the identity

  • display_name string
  • email string
  • source_type string

    Identity node type in the graph, e.g. okta_user, entra_user

  • workflow_name string

    Workflow name snapshotted at execution time, so org-scoped execution feeds render without a per-row workflow lookup.

  • lifecycle string

    Possible values: [joiner, mover, leaver, risk_signal]

    Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

  • retry_of uuid

    When this execution was created by the retry endpoint, the ID of the ORIGINAL failed execution its retry chain re-runs. Retrying a retry keeps pointing at that root rather than at the retry, so every attempt of one run shares the same retry_of and only one of them can be in flight at a time.

  • input_count integer

    DEPRECATED - Use data_input_execution.input_count instead

  • filtered_count integer

    DEPRECATED - Use data_input_execution.filtered_count instead

  • actions_count integer

    DEPRECATED - Use action_executions map instead

  • actions_run object[]

    DEPRECATED - Use action_executions map instead

  • action_id string

    ID of the executed action

  • action_type string

    Possible values: [remediation, ticket, data_sink, webhook, notification, condition, access_review]

    Type of workflow action

  • started_at date-time
  • completed_at date-time
  • success boolean
  • error string
  • remediation_result object
  • ticket_result object
  • data_sink_result object