Create a new workflow

Creates a new workflow for automated response actions

Header Parameters

• SlashID-OrgID string required

  The organization ID

  Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1

application/json

Request Body required

Workflow creation request

• name string required

  Possible values: non-empty and <= 255 characters

  Workflow name

• description string

  Possible values: <= 1000 characters

  Workflow description

• authoring_model string

  Possible values: [raw, jml]

  When "jml", jml_source is required and data_input_config/actions/ starting_actions must be absent — those are compiler output. See WorkflowConfiguration.authoring_model for the full contract (including why this is unrelated to the kind discriminator).

• jml_source object

  lifecycle string required

  Possible values: [joiner, mover, leaver, risk_signal]

  Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

  trigger object required

  Exactly one of event or events must be set. events is the current form — the UI's "Someone joins" chip compiles to [created, reactivated]; event is kept for existing sources and is treated as a one-element events.

  event string

  Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold]

  Type of user lifecycle event that triggers the workflow. Phase 1 (Core): created, deleted, suspended Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

  events string[]

  Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold], >= 1

  The lifecycle events that fire this workflow. Any one of them arriving from a source connection starts a run.

  source_connections string[] required

  Possible values: >= 1

  filters object[]

  attr string required

  Attribute key to compare, e.g. "employee_type". The reserved key "group" matches on the identity's group memberships (the graph's IS_MEMBER_OF edge) instead of a raw attribute: the value is a group name, and eq also accepts the group's entity_id. A filter holds when any group satisfies it; ne holds when none equals it.

  op string required

  Possible values: [eq, ne, co, sw, ew, pr]

  Comparison operator (equals, not-equals, contains, starts-with, ends-with, present).

  value

  phases object required

  The three fixed phases. The boundary is load-bearing: the Mover/Leaver access diff is computed over access only.

  before object[]

  type string required

  Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

  Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  id string

  Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

  Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

  Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  name string

  Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  connection string

  Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  granting_type string

  Used by grant, revoke — e.g. "okta_group".

  granting_id string

  Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  granting_id_ref object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  subject object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  role_id string

  Used by role. The JMLRole whose entitlements are granted.

  target string

  Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  channel string

  Used by notify — e.g. "email", "slack".

  to string

  Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  provider string

  Used by ticket — e.g. "jira", "servicenow".

  params object

  Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

  A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  enabled boolean

  Default value: true

  When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  access object[]

  Only grant and role steps contribute here; access is folded into one access_policy node at compile time.

  type string required

  Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

  Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  id string

  Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

  Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

  Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  name string

  Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  connection string

  Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  granting_type string

  Used by grant, revoke — e.g. "okta_group".

  granting_id string

  Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  granting_id_ref object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  subject object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  role_id string

  Used by role. The JMLRole whose entitlements are granted.

  target string

  Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  channel string

  Used by notify — e.g. "email", "slack".

  to string

  Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  provider string

  Used by ticket — e.g. "jira", "servicenow".

  params object

  Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

  A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  enabled boolean

  Default value: true

  When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  after object[]

  type string required

  Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

  Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  id string

  Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

  Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

  Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  name string

  Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  connection string

  Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  granting_type string

  Used by grant, revoke — e.g. "okta_group".

  granting_id string

  Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  granting_id_ref object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  subject object

  A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

  from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  from_step string

  The id of an earlier step in the policy's chain.

  output string

  The name of an output that step declares.

  from_trigger string

  A value of the triggering identity, e.g. "email" or "attributes.department".

  role_id string

  Used by role. The JMLRole whose entitlements are granted.

  target string

  Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  channel string

  Used by notify — e.g. "email", "slack".

  to string

  Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  provider string

  Used by ticket — e.g. "jira", "servicenow".

  params object

  Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

  A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  enabled boolean

  Default value: true

  When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

• data_input_config object

  oneOf

  • MOD1
  • MOD2
  • MOD3
  • MOD4

  ---

  type string required

  Possible values: [detection]

  Data input type discriminator

  scim_filter string required

  Possible values: non-empty

  SCIM filter string to apply when querying detections. Examples:

  • severity eq "critical"
  • type eq "aws_identity_unused" and status eq "detected"
  • entity_type eq "aws_iam_user"
  • severity eq "critical" or severity eq "high"

  include_suppressed boolean

  Default value: false

  By default the input only returns active detections that no detection rule suppressed: the filter is narrowed with not (suppressed_by_rule_id pr) and, when it does not mention status, to the active statuses. Set to true to pass scim_filter through untouched.

  limit integer

  Possible values: <= 10000

  Maximum number of detections to retrieve (0 for no limit)

  sorting object[]

  Sorting configuration for results

  field string required

  Field to sort by

  direction string required

  Possible values: [asc, desc]

  Default value: desc

  Sort direction

  type string required

  Possible values: [lifecycle]

  Data input type discriminator

  event_types string[] required

  Possible values: [created, deleted, suspended, modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold], >= 1

  Lifecycle events that trigger this workflow

  entity_types string[]

  Filter by entity types (e.g., aws_iam_user, entra_user). If empty, all entity types are matched.

  source_types string[]

  Filter by identity source types (e.g., aws_account, entra). If empty, all source types are matched.

  connection_ids string[]

  Filter by specific connection IDs. If empty, all connections are matched.

  min_risk_score integer

  Possible values: <= 100

  Only trigger for entities with risk score >= this value

  max_risk_score integer

  Possible values: <= 100

  Only trigger for entities with risk score <= this value

  include_relationships boolean

  Default value: false

  Fetch manager, groups, direct reports from Neo4j

  include_permissions boolean

  Default value: false

  Fetch permission assignments from Neo4j

  include_access_history boolean

  Default value: false

  Fetch recent access records from Neo4j

  relationship_depth integer

  Possible values: <= 3

  Default value: 1

  How deep to traverse relationships in Neo4j (default 1, max 3)

  scim_filter string

  Additional SCIM-style filter criteria for the entity

  attribute_filters object[]

  Conditions on the triggering identity's raw source attributes, evaluated against data.attributes.*. Populated by JML compilation from JMLSource.trigger.filters — deliberately NOT compiled into scim_filter above, whose grammar cannot express a data.attributes.<key> path. Can also be set directly on a raw (non-JML) lifecycle data input.

  attr string required

  Attribute key to compare, e.g. "employee_type". The reserved key "group" matches on the identity's group memberships (the graph's IS_MEMBER_OF edge) instead of a raw attribute: the value is a group name, and eq also accepts the group's entity_id. A filter holds when any group satisfies it; ne holds when none equals it.

  op string required

  Possible values: [eq, ne, co, sw, ew, pr]

  Comparison operator (equals, not-equals, contains, starts-with, ends-with, present).

  value

  type string required

  Possible values: [uar_finding]

  Data input type discriminator

  triggers string[]

  UarFindingV1 trigger reasons that fire this workflow (ANY match). Defaults to ["manual"] when empty.

  campaign_ids uuid[]

  Filter by specific campaign IDs. Empty matches all.

  campaign_template_ids uuid[]

  Filter by campaign template IDs. Empty matches all.

  campaign_types string[]

  Filter by campaign type (e.g. user, resource, non_human_identity). Empty matches all.

  classification_tags string[]

  Filter by classification tags on the finding. Empty matches all.

  outcomes string[]

  Filter by reviewer decision outcome (e.g. approve, revoke). Empty matches all.

  only_effective boolean

  Default value: false

  Match only when effective_outcome == outcome — the decision survived multi-tier escalation rather than being overridden.

  min_level integer

  Filter by decision level >= this value.

  only_high_privilege boolean

  Default value: false

  Restrict to findings flagged as high-privilege.

  user_source_types string[]

  Filter by user identity source type. Empty matches all.

  user_entity_types string[]

  Filter by user entity type. Empty matches all.

  asset_source_types string[]

  Filter by asset source type. Empty matches all.

  asset_entity_types string[]

  Filter by asset entity type. Empty matches all.

  granting_entity_types string[]

  Filter by granting entity type (e.g. role, group). Empty matches all.

  scim_filter string

  Optional SCIM-style filter over the flattened finding payload, applied after the structured filters above.

  type string required

  Possible values: [cypher_query]

  Data input type discriminator

  query string required

  Possible values: non-empty and <= 10000 characters

  Read-only Cypher query whose rows feed downstream workflow actions. Must contain MATCH and RETURN clauses. Write operations and the USE clause are rejected by the validator. Comments and strings are tokenized before validation, so a write keyword inside a string literal is allowed.

  parameters object

  Parameters bound into the query at execution time. Keys must match the $name placeholders in query. Values are passed verbatim to the Neo4j driver.

  max_rows integer

  Possible values: >= 1 and <= 10000

  Default value: 1000

  Maximum rows returned by a scheduled execution (NOT the preview). Capped server-side at 10000.

  timeout_seconds integer

  Possible values: >= 1 and <= 300

  Default value: 30

  Per-execution query timeout (NOT the preview). Capped server-side at 300.

  on_limit_exceeded string

  Possible values: [fail, truncate]

  Default value: fail

  Behavior when the query returns more than max_rows. fail aborts the execution with an error; truncate returns the first max_rows rows and marks the execution as truncated.

  primary_entity_column string

  Optional. Name of a query result column whose value is the primary entity ID for each row. When set, downstream remediation actions can target this entity. Must match one of the column aliases in the query's RETURN clause.

  name string

  Possible values: <= 128 characters, Value must match regular expression ^[A-Za-z0-9][A-Za-z0-9 _.:-]*$

  Name of the custom detection the rows become. The emitted detections carry the type custom:<name>; when omitted they carry custom_cypher_detection.

  severity string

  Possible values: [critical, high, medium, low]

  Default value: medium

  Severity of the emitted detections.

  category string

  Default value: custom

  Category of the emitted detections: custom, or the name of a registered detection category or subcategory.

• actions object

  Actions configuration for a raw (non-JML) workflow. Map of action ID to action configuration. Rejected with 400 alongside authoring_model=jml.

  discriminator

  Possible values: [remediation, ticket, data_sink, webhook, notification, condition, access_review]

  oneOf
• starting_actions string[]

  IDs of actions to execute first (after data input), for a raw (non-JML) workflow. Rejected with 400 alongside authoring_model=jml.

Responses

• 201
• 400
• 409

---

Workflow created successfully

application/json

• Schema
• Example (from schema)

---

Schema

• meta object

  pagination object

  limit integer

  offset integer

  total_count int64

  cursor_pagination object

  Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  limit integer

  next_cursor string

  Opaque token addressing the next page. Absent on the last page.

  prev_cursor string

  Opaque token addressing the previous page. Absent on the first page.

  last_cursor string

  Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  total_count int64

  Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

• errors object[]

  httpcode integer

  message string

  code string

  Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

• result object

  kind string

  Possible values: [workflow, workflow_with_configuration]

  Discriminator for the GET /workflows/{id} response variant. workflow is returned when include_configuration=false; workflow_with_configuration when the latest version is bundled into the response. The enum lists both values intentionally so the schema composition WorkflowWithConfiguration = allOf [Workflow, WorkflowConfiguration] doesn't produce an unsatisfiable enum constraint; the discriminator on the endpoint's oneOf does the runtime dispatch. Required so the typescript-fetch generator emits switch-based dispatch (needed since openapi-generator-cli v7 — see PR #5928) instead of order-sensitive instanceOf checks that silently drop the configuration fields when both schemas overlap.

  id string

  Unique workflow identifier

  org_id string

  Organization ID

  name string

  Possible values: non-empty and <= 255 characters

  Workflow name

  description string

  Possible values: <= 1000 characters

  Workflow description

  lifecycle string

  Possible values: [joiner, mover, leaver, risk_signal]

  Which lifecycle a JML workflow models. risk_signal fires on risk_score_changed / inactive_threshold events; it computes no access diff, so grant/revoke steps are rejected and only the before/after phases run.

  status string

  Possible values: [draft, active, paused, deleted]

  Current state of a workflow

  created_by string

  User ID who created the workflow

  created_at date-time

  Workflow creation timestamp

  updated_by string

  User ID who last updated the workflow

  updated_at date-time

  Last update timestamp

  activated_at date-time

  When workflow was first activated

  paused_at date-time

  When workflow was paused

  paused_by string

  User ID who paused the workflow. Set when the workflow is paused, cleared on resume.

  last_executed_at date-time

  Last execution timestamp

  execution_count integer

  Total execution count

  success_count integer

  Successful execution count

  failure_count integer

  Failed execution count

  latest_configuration_id string

  ID of the latest configuration version

  latest_configuration_version integer

  Latest configuration version number

{
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total_count": 0
    },
    "cursor_pagination": {
      "limit": 0,
      "next_cursor": "string",
      "prev_cursor": "string",
      "last_cursor": "string",
      "total_count": 0
    }
  },
  "errors": [
    {
      "httpcode": 0,
      "message": "string",
      "code": "string"
    }
  ],
  "result": {
    "kind": "workflow",
    "id": "string",
    "org_id": "string",
    "name": "string",
    "description": "string",
    "lifecycle": "joiner",
    "status": "draft",
    "created_by": "string",
    "created_at": "2005-12-24T18:29:30.033157Z",
    "updated_by": "string",
    "updated_at": "2005-12-24T18:29:30.033157Z",
    "activated_at": "2005-12-24T18:29:30.033157Z",
    "paused_at": "2005-12-24T18:29:30.033157Z",
    "paused_by": "string",
    "last_executed_at": "2005-12-24T18:29:30.033157Z",
    "execution_count": 0,
    "success_count": 0,
    "failure_count": 0,
    "latest_configuration_id": "string",
    "latest_configuration_version": 0
  }
}

Bad Request

application/json

• Schema
• Example (from schema)

---

Schema

• meta object

  pagination object

  limit integer

  offset integer

  total_count int64

  cursor_pagination object

  Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  limit integer

  next_cursor string

  Opaque token addressing the next page. Absent on the last page.

  prev_cursor string

  Opaque token addressing the previous page. Absent on the first page.

  last_cursor string

  Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  total_count int64

  Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

• errors object[]

  httpcode integer

  message string

  code string

  Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

{
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total_count": 0
    },
    "cursor_pagination": {
      "limit": 0,
      "next_cursor": "string",
      "prev_cursor": "string",
      "last_cursor": "string",
      "total_count": 0
    }
  },
  "errors": [
    {
      "httpcode": 0,
      "message": "string",
      "code": "string"
    }
  ]
}

Conflict

application/json

• Schema
• Example (from schema)

---

Schema

• meta object

  pagination object

  limit integer

  offset integer

  total_count int64

  cursor_pagination object

  Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  limit integer

  next_cursor string

  Opaque token addressing the next page. Absent on the last page.

  prev_cursor string

  Opaque token addressing the previous page. Absent on the first page.

  last_cursor string

  Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  total_count int64

  Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

• errors object[]

  httpcode integer

  message string

  code string

  Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

{
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total_count": 0
    },
    "cursor_pagination": {
      "limit": 0,
      "next_cursor": "string",
      "prev_cursor": "string",
      "last_cursor": "string",
      "total_count": 0
    }
  },
  "errors": [
    {
      "httpcode": 0,
      "message": "string",
      "code": "string"
    }
  ]
}