openapi: 3.2.0
info:
  license:
    name: GPL-v2.0
    url: http://www.gnu.org/licenses/gpl-2.0.txt
  version: 1.0.9
  title: Bonita Activity API
  description: "<p> \n<a download=\"openapi.yaml\" href=\"./openapi.yaml\" target=\"_blank\" class=\"btn-download\">Download OpenAPI specification</a>\n<a download=\"postman.json\" href=\"./postman.json\" target=\"_blank\" class=\"btn-download\">Download Postman collection</a>\n</p>\n\n<hr>\n\nThe REST API lets you access the data with HTTP requests; it is useful when implementing rich web forms / pages for a good user experience.\n\nAn open source [java client](https://github.com/bonitasoft/bonita-java-client) is implemented above the HTTP API. It is available on [Maven central](https://search.maven.org/search?q=g:%22org.bonitasoft.web%22%20AND%20a:%22bonita-java-client%22).\n\nIf your application is using a technology other than Java, you can integrate it with the Bonita solution using the Web REST API. This API provides\naccess to all Bonita objects (like processes, tasks, users, connectors etc.), to execute operations on them (create, retrieve, update, delete).\nYou can use these operations to create a workflow with Bonita and integrate it into your application. The Bonita Engine remains responsible for executing\nthe workflow logic (connectors, gateways with conditions, messages, timers etc.) while your application gives access to the workflow.\nUsers can manage processes and tasks, and perform administrative activities.\n\n### API Extensions\n\nYou can create [Rest API Extensions](https://documentation.ofelia.com/bonita/latest/api/rest-api-extensions) to extend the Rest API by adding missing resources (not provided by the Rest API).\nIt is possible for an extension to interact with the engine (via the API) or with any other external service (for example a database, a directory, or a web service).\n\n### Create a resource\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/  `|\n|:-|:-|\n| Request Method | POST|\n| Request Payload | an item in JSON|\n| Response | the same item in JSON, containing the values provided in the posted item, completed with default values and identifiers provided by Bonita Engine.|\n\n### Read a resource\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/{id} `|\n|:-|:-|\n| Request Method | GET|\n| Response | an item in JSON|\n\nExample `http://.../API/identity/user/5 `\n\n#### Extend resource response\n\nOn some resources, in GET methods the `d` (deploy) URL query parameter can be used to extend the response objects. The value of this parameter consists of an attribute for which you want to make an extended request (called a deploy) and retrieve attributes of a linked resource.\nThis means that instead of retrieving the ID or a parent or referenced resource, you can retrieve the full object.\n\nFor example, when you retrieve a task, you can also retrieve the process definition attributes in addition to the process definition ID that is already part of the task resource.\nThe supported deploy values for a task include its process (d=processId).\n\nSpecifiy multiple `d` parameter to extend several resources. For instance, to retrieve the flow node of id 143 and the associated process, process instance and assigned user, call `/API/bpm/flowNode/143?d=processId&d=caseId&d=assigned_id`\n\n#### With compound identifier\n\nThe order of the identifier parts for each resource type is given in the table above.\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/{id_part1}/{id_part2} `|\n|:-|:-|\n| Request Method | GET|\n| Response | an item in JSON|\n\nExample `http://.../API/identity/membership/5/12/24 `\n\n### Update a resource\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/{id} `|\n|:-|:-|\n| Request Method | PUT|\n| Request Payload | a map in JSON containing the new values for the attributes you want to change.|\n| Response | the corresponding item in JSON with new values where you requested a modification|\n\nExample `http://.../API/identity/user/5`\n\n#### With compound identifier:\n\nResponse: the corresponding item in JSON with new values where you requested a modification.\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/{id_part1}/{id_part2} `|\n|:-|:-|\n| Request Method | PUT|\n| Request Payload | ` a map in JSON containing the new values for the attributes you want to change `|\n| Response | ` the corresponding item in JSON with new values where you requested a modification`|\n\nExample\n`http://.../API/identity/membership/5/12/24 `\n\n### Delete resources\n\nUse the DELETE request to remove multiple resources.\n\n| Request URL | `http://.../API/{API_name}/{resource_name}/ `|\n|:-|:-|\n| Request Method | DELETE|\n| Request Payload | A list of identifiers in JSON, for example `[\"id1\",\"id2\",\"id3\"]`. Compound identifiers are separated by '/' characters.|\n| Response | `empty `|\n\nExample\n`http://.../API/identity/membership/ `\n\n### Search for a resource\n\nThe required object is specified with a set of filters in the request URL. The URL parameters must be URL-encoded.\n\nResults are returned in a paged list, so you have to specify the page (counting from zero), and the number of results per page (count), additionally you can define a sort key (order). You can see the total number of matching results in the HTTP response header Content-Range.\nIf you are searching for business data using a custom query, there must be a [count query in the BDM](https://documentation.ofelia.com/bonita/latest/data/define-and-deploy-the-bdm). If there is no count query, results from a custom query on business data cannot be paged properly (the header Content-Range will be absent).\nFor business data default queries, the count query is defined automatically.\n\nThe available filters are the attributes of the item plus some specific filters defined by each item.\n\n| Request URL | `http://.../API/{API_name}/{resource_name}?p={page}&c={count}&o={order}&s={query}&f={filter_name}={filter_value}&f=... `|\n|:-|:-|\n| Request Method | GET|\n| Response | an array of items in JSON|\n\nExample\n`/API/identity/user?p=0&c=10&o=firstname&s=test&f=manager_id=3`\n\nFor a GET method that retrieves more than one instance of a resource, you can specify the following request parameters:\n\n* p (Mandatory): index of the page to display\n* c (Mandatory): maximum number of elements to retrieve\n* o: order of presentation of values in response: must be either `attributeName ASC` or `attributeName DESC`. The final order parameter value must be URL encoded.\n* f: list of filters, specified as `attributeName=attributeValue`. To filter on more than one attribute, specify an f parameters for each attribute. The final filter parameter value must be URL encoded.\n  The attributes you can filter on are specific to the resource.\n* s: search on name or search indexes. Before Bonita 2024.1, the matching policy depended on the configuration of [word-based search](https://documentation.ofelia.com/bonita/2023.2/api/using-list-and-search-methods#word_based_search).\n  For example, if word-based search was enabled, `s=Valid` returned matches containing the string \"valid\" at the start of any word in the attribute value word,\n  such as \"Valid address\", \"Not a valid address\", and \"Validated request\" but not \"Invalid request\".\n  If word-based search was disabled, `s=Valid` returned matches containing the string \"valid\" at the start of the attribute value, such as \"Valid address\" or \"Validated request\" but not \"Not a valid address\" or \"Invalid request\".\n  Since Bonita 2024.1, the search mode can no longer be configured and a \"like-based\" algorithm is used. This means all the matching records for which the search term occurs anywhere in a phrase or a word are returned.\n\n### Errors\n\nThe API uses standard HTTP status codes to indicate the success or failure of the API call.\n\nIf you get a `401` response code :\n  - make sure that the cookies have been transfered with the call\n  - make sure that the cookies transfered are the ones generated during the last sucessfull login call\n  - if one of the PUT, DELETE or POST method is used, make sure that the `X-Bonita-API-Token` header is included\n  - if the X-Bonita-API-Token header is included, make sure that the value is the same as the one of the cookie generated during the last login\n  - Maybe a logout was issued or the session has expired; try to log in again, and re run the request with the new cookies and the new value for the `X-Bonita-API-Token` header.\n"
  x-logo:
    url: images/ofelia-logo.svg
    backgroundColor: '#19465f'
    altText: Bonita API
    href: /
servers:
- url: http://localhost:8080/bonita
  description: Sample url for a local development server.
security:
- bonita_auth: []
  bonita_token: []
- bearer_auth: []
tags:
- name: Activity
  x-displayName: Activity
  description: Activity
paths:
  /API/bpm/activity:
    get:
      tags:
      - Activity
      summary: Finds Activities
      description: 'Finds Activities with pagination params and filters. Activities in states completed, cancelled, or aborted are not retrieved. The search returns an array of activities.


        - can order on `name`, `displayName`, `state`, `processDefinitionId`, `parentProcessInstanceId`, `parentActivityInstanceId` (order by parent activity id), `rootProcessInstanceId`, `lastUpdateDate`

        - can search on `name`, `displayName`, `state`, `processDefinitionId`, `parentProcessInstanceId`, `parentActivityInstanceId` (order by parent activity id), `rootProcessInstanceId`, `lastUpdateDate`

        - can filter on `name`, `state`, `processId`, `parentProcessInstanceId`, `rootProcessInstanceId`, `last_update_date`, `supervisor_id` (only in Enterprise editions)

        '
      operationId: searchActivities
      parameters:
      - $ref: '#/components/parameters/pageIndex'
      - $ref: '#/components/parameters/pageCount'
      - $ref: '#/components/parameters/pageFilter'
      - $ref: '#/components/parameters/pageOrder'
      - $ref: '#/components/parameters/pageSearch'
      responses:
        '200':
          description: 'Success '
          headers:
            Content-Range:
              schema:
                type: integer
                format: int64
              description: The total number of matching items
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Activity'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        5XX:
          $ref: '#/components/responses/ServerError'
  /API/bpm/activity/{id}:
    get:
      tags:
      - Activity
      summary: Finds the Activity by ID
      description: 'Returns the single Activity for the given ID

        '
      operationId: getActivityById
      parameters:
      - description: ID of the Activity to return
        in: path
        name: id
        required: true
        schema:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
      responses:
        '200':
          description: 'Success '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Activity'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        5XX:
          $ref: '#/components/responses/ServerError'
    put:
      tags:
      - Activity
      summary: Update the Activity by ID
      description: 'Update the Activity for the given ID

        '
      operationId: updateActivityById
      parameters:
      - description: ID of the Activity to return
        in: path
        name: id
        required: true
        schema:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivityUpdateRequest'
        description: Partial Activity description
        required: true
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        5XX:
          $ref: '#/components/responses/ServerError'
components:
  parameters:
    pageOrder:
      description: can order on attributes
      explode: true
      in: query
      name: o
      required: false
      schema:
        type: string
        maxLength: 250
        pattern: ^[A-Za-z0-9%]{0,250}$
      style: form
      example: myProp%20ASC
    pageCount:
      description: maximum number of elements to retrieve
      explode: true
      in: query
      name: c
      example: '10'
      required: true
      schema:
        type: integer
        minimum: 1
        default: 20
        format: int32
      style: form
    pageIndex:
      description: index of the page to display
      explode: true
      in: query
      name: p
      example: '0'
      required: true
      schema:
        type: integer
        minimum: 0
        default: 0
        format: int32
      style: form
    pageSearch:
      description: can search on attributes
      explode: true
      in: query
      name: s
      required: false
      schema:
        type: string
        maxLength: 250
        pattern: ^[A-Za-z0-9%]{0,250}$
      style: form
    pageFilter:
      description: can filter on attributes with the format f={filter\_name}={filter\_value} with the name/value pair as url encoded string.
      explode: true
      in: query
      name: f
      required: false
      schema:
        type: array
        items:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9%]{0,250}$
      style: form
      example: abc%3d123
  schemas:
    ActivityPriority:
      type: string
      description: the priority of the current activity
      enum:
      - highest
      - above_normal
      - normal
      - under_normal
      - lowest
    ActivityType:
      type: string
      description: the activity type (string)
      enum:
      - AUTOMATIC_TASK
      - HUMAN_TASK
      - USER_TASK
      - MANUAL_TASK
      - LOOP_ACTIVITY
      - MULTI_INSTANCE_ACTIVITY
      - CALL_ACTIVITY
    ActivityUpdateRequest:
      type: object
      properties:
        variables:
          description: 'Activity variables to update.


            **Note**: if there is no data with the specified name in the activity,

            the update will be applied to the process data if a variable with the specified name exists.


            **Note**: if the task definition includes a connector that is executed on finish and updates the value of a variable, the value set by the REST API call is overwritten.

            '
          type: string
        state:
          description: 'The target state of the activity

            - Execute a task: `completed`

            - Skip activity: `skipped` - Make this call after all failed connectors have been reset ![edition](https://img.shields.io/badge/edition-entreprise-blue)

            - Replay activity: `replay`

            '
          type: string
      example:
        variables: '[{"name":"foo","value":"bar"}]'
        state: completed
    Activity:
      type: object
      description: 'Use this resource to retrieve activities (human or service tasks), call activities, and subprocesses currently running on the platform.

        It enables you to perform maintenance tasks like skipping or replaying a failed task and modifying variables.

        '
      properties:
        id:
          type: string
          description: the activity id
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
        type:
          $ref: '#/components/schemas/ActivityType'
        name:
          type: string
          description: the activity technical name
        displayName:
          type: string
          description: the human readable activity name
        description:
          type: string
          description: the activity description
        displayDescription:
          type: string
          description: the human readable activity description
        state:
          $ref: '#/components/schemas/ActivityState'
        reached_state_date:
          type: string
          description: the date ('yyyy-MM-dd HH:mm:ss.SSS') when this activity reached the current state, for example '2014-10-17 16:05:42.626'
        last_update_date:
          type: string
          description: the date ('yyyy-MM-dd HH:mm:ss.SSS') when this activity was last updated, for example '2014-10-17 16:05:42.626)
        dueDate:
          type: string
          description: the date ('yyyy-MM-dd HH:mm:ss.SSS') when this activity is due, for example '2014-10-17 16:05:42.626'
        priority:
          $ref: '#/components/schemas/ActivityPriority'
        processId:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the process definition id of the process instance which define this activity
        parentCaseId:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the immediate containing process instance id (long, a.k.a process instance id)
        rootCaseId:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the top/root process instance id (long, a.k.a case id). In case of an event sub process, `parentCaseId` will the id of the process instance called while `rootCaseId` will be the one from the caller process instance
        rootContainerId:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: same as rootCaseId
        executedBy:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the id of the user who performed this activity. The activity has to be a human task otherwise its value will be 0
        executedBySubstitute:
          type: string
          description: the id of the user who did actually performed the activity when it has been done in the name of someone else. Value is 0 otherwise
        actorId:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the id of the actor that can execute this activity, null otherwise
        assigned_id:
          type: string
          maxLength: 250
          pattern: ^[A-Za-z0-9\_\-\.]{0,250}$
          description: the user id that this activity is assigned to, or 0 if it is unassigned
        assigned_date:
          type: string
          pattern: ^\d{4}-\d{2}-\d{2}\s\d+:\d+:\d+\.\d+$
          description: the date ('yyyy-MM-dd HH:mm:ss.SSS') when the current activity was assigned, for example '2014-10-17 16:05:42.626'
      example:
        displayDescription: validate expense request
        executedBySubstitute: '0'
        caseId: '76539'
        parentCaseId: '68743'
        rootCaseId: '65879'
        processId: '7012'
        rootContainerId: '7000'
        state: completed
        type: the activity type as a string
        assigned_id: '304'
        assigned_date: '2014-10-17 16:05:42.626'
        id: '809764'
        executedBy: '0'
        priority: the priority of the current activity as a string
        actorId: '50'
        description: In this step a manager reviews and validates an expense request.
        name: Validate
        reached_state_date: '2014-10-18 10:37:05.643'
        displayName: Validate expense request
        dueDate: '2014-10-21 16:05:42.626'
        last_update_date: '2014-10-18 10:37:05.643'
    ActivityState:
      type: string
      description: the current state of the activity
      enum:
      - failed
      - initializing
      - ready
      - executing
      - completing
      - completed
      - waiting
      - skipped
      - cancelled
      - aborted
      - cancelling subtasks
      - aborting activity with boundary
      - completing activity with boundary
    Error:
      type: object
      additionalProperties: true
      properties:
        message:
          type: string
          description: The error message
        exception:
          type: string
          description: The exception type
        explanations:
          description: Further details on the error
          type: array
          items:
            type: string
  responses:
    ServerError:
      description: Unexpected error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: An unexpected error occured.
    NotFound:
      description: The resource for the specified ID was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Resource not found.
    OK:
      description: OK
    Forbidden:
      description: Forbidden, The request contained valid data and was understood by the server, but the server is refusing action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Forbidden, The request contained valid data and was understood by the server, but the server is refusing action.
    BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Bad request
    Unauthorized:
      description: Authorization information is missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Unauthorized
  securitySchemes:
    bonita_auth:
      name: JSESSIONID
      description: 'To call the REST API, you must first log on with a user registered in the Engine database. Please refer to the __[Login API](#operation/login)__ operations section.

        '
      type: apiKey
      in: cookie
    bonita_token:
      name: X-Bonita-API-Token
      description: 'To call the REST API, you must first log on with a user registered in the Engine database. Please refer to the __[Login API](#operation/login)__ operations section.

        '
      type: apiKey
      in: header
    bearer_auth:
      description: '![edition](https://img.shields.io/badge/edition-entreprise-blue)


        When Bonita runtime is configured for SSO with openID Connect it is possible To call the REST API directly with a Bearer Authorization header containing the access token.

        '
      type: http
      scheme: bearer
x-tagGroups:
- name: Authentication
  tags:
  - Authentication
  - PlatformAuthentication
- name: Application
  tags:
  - Application
  - ApplicationMenu
  - ApplicationPage
  - FormMapping
- name: BDM
  tags:
  - BDM
  - BusinessDataQuery
  - Business Data Operations
  - BDMAccessControl
  - DataRetention
- name: BPM
  tags:
  - Activity
  - ArchivedActivity
  - HumanTask
  - ManualTask
  - Task
  - UserTask
  - ArchivedHumanTask
  - ArchivedManualTask
  - ArchivedTask
  - ArchivedUserTask
  - ActivityVariable
  - ArchivedActivityVariable
  - ProcessInstanceVariable
  - ArchivedProcessInstanceVariable
  - ProcessInstanceDocument
  - ArchivedProcessInstanceDocument
  - Actor
  - ActorMember
  - ProcessInstance
  - ArchivedProcessInstance
  - ProcessInstanceInfo
  - ProcessInstanceComment
  - ArchivedProcessInstanceComment
  - Process
  - Diagram
  - ProcessInfo
  - ProcessParameter
  - ProcessResolutionProblem
  - ProcessSupervisor
  - ProcessConnectorDependency
  - ConnectorFailure
  - ConnectorInstance
  - ArchivedConnectorInstance
  - FlowNode
  - ArchivedFlowNode
  - Failure
  - ArchivedFailure
  - TimerEventTrigger
  - Message
  - Signal
  - Delegation
- name: Custom user info
  tags:
  - CustomUserDefinition
  - CustomUserValue
  - CustomUser
- name: Identity
  tags:
  - ProfessionalContactData
  - Group
  - Membership
  - Role
  - User
  - Authentication
- name: Platform
  tags:
  - PlatformAuthentication
  - Platform
  - License
  - Information
- name: Portal
  tags:
  - Page
  - Profile
  - ProfileEntry
  - ProfileMember
  - Theme
  - Upload
- name: System
  tags:
  - I18nlocale
  - I18ntranslation
  - Log
  - Session
  - Maintenance
- name: Other
  tags:
  - RestAPIextensions
- name: Upload
  tags:
  - FormFileUpload