Skip to main content

List workflow versions​

Retrieve all versions of a workflow

Path Parameters
  • workflow_id string required

    Workflow identifier

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

List of workflow versions

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object
  • versions object[]
  • id string

    Unique configuration identifier

  • workflow_id string

    Parent workflow ID

  • org_id string

    Organization ID

  • version integer

    Possible values: >= 1

    Configuration version number

  • data_input_config object
    oneOf
  • type string

    Possible values: [detection]

    Data input type discriminator

  • scim_filter string

    Possible values: non-empty

    SCIM filter string to apply when querying detections. Examples:

    • severity eq "critical"
    • type eq "aws_identity_unused" and status eq "detected"
    • entity_type eq "aws_iam_user"
    • severity eq "critical" or severity eq "high"
  • include_suppressed boolean

    Default value: false

    By default the input only returns active detections that no detection rule suppressed: the filter is narrowed with not (suppressed_by_rule_id pr) and, when it does not mention status, to the active statuses. Set to true to pass scim_filter through untouched.

  • limit integer

    Possible values: <= 10000

    Maximum number of detections to retrieve (0 for no limit)

  • sorting object[]

    Sorting configuration for results

  • field string

    Field to sort by

  • direction string

    Possible values: [asc, desc]

    Default value: desc

    Sort direction

  • actions object

    Actions configuration. Map of action ID to action configuration.

  • discriminator

    Possible values: [remediation, ticket, data_sink, webhook, notification, condition, access_review]

  • oneOf
  • starting_actions string[]

    IDs of actions to execute first (after data input).

  • schedule string

    Optional cron expression (5-field, UTC). When non-empty, the workflow is registered with the scheduler and fires on each tick (cron parser: github.com/hashicorp/cronexpr). Must be empty when data_input_config.type is lifecycle — lifecycle workflows are event-driven and cannot be scheduled.

  • authoring_model string

    Possible values: [raw, jml]

    Discriminates how this configuration was authored. "raw" (default) means data_input_config/actions/starting_actions were authored directly. "jml" means jml_source is the source of truth and those three fields are compiled output: they are derived from jml_source on every write and a request that supplies them directly alongside authoring_model=jml is rejected with 400.

    NOTE: this is a different discriminator from kind on the Workflow/WorkflowWithConfiguration response — kind is a response-variant discriminator (workflow vs workflow_with_configuration) used by the generated client to dispatch a oneOf, and has nothing to do with JML. Dispatch the JML editor vs the raw DAG editor on authoring_model, not kind.

  • jml_source object
  • lifecycle string

    Possible values: [joiner, mover, leaver, risk_signal]

    Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

  • trigger object

    Exactly one of event or events must be set. events is the current form — the UI's "Someone joins" chip compiles to [created, reactivated]; event is kept for existing sources and is treated as a one-element events.

  • event string

    Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold]

    Type of user lifecycle event that triggers the workflow. Phase 1 (Core): created, deleted, suspended Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

  • events string[]

    Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold], >= 1

    The lifecycle events that fire this workflow. Any one of them arriving from a source connection starts a run.

  • source_connections string[]

    Possible values: >= 1

  • filters object[]
  • attr string

    Attribute key to compare, e.g. "employee_type". The reserved key "group" matches on the identity's group memberships (the graph's IS_MEMBER_OF edge) instead of a raw attribute: the value is a group name, and eq also accepts the group's entity_id. A filter holds when any group satisfies it; ne holds when none equals it.

  • op string

    Possible values: [eq, ne, co, sw, ew, pr]

    Comparison operator (equals, not-equals, contains, starts-with, ends-with, present).

  • value
  • phases object

    The three fixed phases. The boundary is load-bearing: the Mover/Leaver access diff is computed over access only.

  • before object[]
  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

    Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  • id string

    Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

    Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

    Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  • name string

    Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  • connection string

    Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  • granting_type string

    Used by grant, revoke — e.g. "okta_group".

  • granting_id string

    Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  • granting_id_ref object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • subject object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • role_id string

    Used by role. The JMLRole whose entitlements are granted.

  • target string

    Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  • channel string

    Used by notify — e.g. "email", "slack".

  • to string

    Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  • provider string

    Used by ticket — e.g. "jira", "servicenow".

  • params object

    Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

    A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  • enabled boolean

    Default value: true

    When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  • access object[]

    Only grant and role steps contribute here; access is folded into one access_policy node at compile time.

  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

    Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  • id string

    Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

    Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

    Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  • name string

    Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  • connection string

    Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  • granting_type string

    Used by grant, revoke — e.g. "okta_group".

  • granting_id string

    Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  • granting_id_ref object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • subject object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • role_id string

    Used by role. The JMLRole whose entitlements are granted.

  • target string

    Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  • channel string

    Used by notify — e.g. "email", "slack".

  • to string

    Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  • provider string

    Used by ticket — e.g. "jira", "servicenow".

  • params object

    Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

    A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  • enabled boolean

    Default value: true

    When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  • after object[]
  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

    Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  • id string

    Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

    Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

    Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  • name string

    Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  • connection string

    Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  • granting_type string

    Used by grant, revoke — e.g. "okta_group".

  • granting_id string

    Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  • granting_id_ref object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • subject object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • role_id string

    Used by role. The JMLRole whose entitlements are granted.

  • target string

    Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  • channel string

    Used by notify — e.g. "email", "slack".

  • to string

    Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  • provider string

    Used by ticket — e.g. "jira", "servicenow".

  • params object

    Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

    A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  • enabled boolean

    Default value: true

    When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  • created_by string

    User ID who created this version

  • created_at date-time

    Version creation timestamp

  • is_latest boolean

    Whether this is the latest version