๐๏ธ List workflows
Retrieve a list of workflows for the organization
๐๏ธ Create a new workflow
Creates a new workflow for automated response actions
๐๏ธ Delete workflow
Soft delete a workflow (marks as deleted)
๐๏ธ Get workflow details
Retrieve details of a specific workflow. When include_configuration=true, the response also includes the latest workflow configuration (data_input_config, actions, version, etc.).
๐๏ธ Update workflow
Update a workflow and create a new version
๐๏ธ List workflow versions
Retrieve all versions of a workflow
๐๏ธ Get specific workflow version
Retrieve a specific version of a workflow
๐๏ธ Restore workflow version
Restore a previous version of a workflow as the latest version
๐๏ธ Activate workflow
Activate a workflow to make it operational
๐๏ธ Pause workflow
Pause an active workflow
๐๏ธ Resume workflow
Resume a paused workflow
๐๏ธ Execute workflow
Manually trigger workflow execution. Execution is asynchronous (tree-based execution publishes starting-action commands and returns) โ the verdict is not in this response; poll GET /workflows/{workflow_id}/executions/{execution_id}.
๐๏ธ List workflow executions across the organization
Cursor-paginated feed of executions across every workflow in the organization, most recent first. Each row carries the denormalized `workflow_name` and, for event-triggered runs, the `trigger` with the subject identity โ so an activity feed renders from this response alone.
๐๏ธ Aggregated workflow run stats for a time window
Run counts over the trailing window, aggregated across every workflow in the organization. Serves activity-feed KPI tiles; lifetime per-workflow counters live on the Workflow object itself.
๐๏ธ List workflow executions
Paginated list of executions for a workflow, most recent first. How a shadow-mode or dry-run reviewer finds the execution they want to inspect.
๐๏ธ Get a workflow execution
Retrieve a single execution โ the dry-run verdict a manual trigger's caller polls for. 404 if the execution does not exist, or exists but belongs to a different workflow or organization.
๐๏ธ Retry the failed steps of a failed execution
Creates a new execution that re-runs only the action nodes that failed (and the ones skipped because of that failure) against the original execution's data items; succeeded steps are not repeated. The new execution has `trigger.kind: retry` and `retry_of` set to the root of this execution's retry chain (this execution's ID, or its own `retry_of` when this execution is itself a retry). Only executions with status `failed` are retryable, and only while the workflow is active; a second retry while one is still running is refused with `409`.
๐๏ธ Discover JML trigger-filter attribute keys
Returns the identity attribute keys observed on the given connections' identities in the graph โ the same `data.attributes.*` a lifecycle data input surfaces to a running workflow. This is a discovery endpoint over observed data, not a curated catalogue: attributes vary per source, so a fixed list would be wrong for every org. Each returned key is directly usable as a `filters[].attr` value on a JMLTrigger.
๐๏ธ Catalogue of JML steps available per connected platform
Returns, for every connection a JML step can act on, the step kinds it supports โ derived from the registered remediation recipes and provisioning targets, so the palette only offers what the engine can dispatch. Each entry maps directly onto a `JMLStep`: `type`, and for grant/revoke the `granting_type`, for provision the `target`, for notify the `channel`, for ticket the `provider` โ plus the `phases` it may be authored in and the `params` its recipe reads. The response also carries the notify channels and ticket providers the compiler accepts, so the builder never keeps its own copy of either list. `builtin_steps` publishes the output descriptors of the step kinds that never appear under a connection (ticket, webhook) โ one entry per (type, provider) pair, so the builder never keeps its own copy of what those steps produce either.
๐๏ธ List JML roles
List JML roles
๐๏ธ Create a JML role
Create a JML role
๐๏ธ Delete a JML role
Delete a JML role
๐๏ธ Get a JML role
Get a JML role
๐๏ธ Update a JML role
Update a JML role
๐๏ธ Internal endpoint for scheduled workflow execution
Internal endpoint invoked by the workflow scheduler (GCP Cloud Scheduler in production, the docker-scheduler in dev) on each cron tick. Publishes a workflow execute event with trigger_source=scheduled. Not intended for external callers.
๐๏ธ Run a read-only Cypher query and return the first 50 rows
Synchronous preview for the Query Workflows UI. Validates the query (same validator as scheduled runs), runs it against the caller's org graph with a 10-second timeout and a hard 50-row cap. Read-only โ write keywords are rejected. Not intended for batch use; use the scheduled-execute path for production reads.