openapi: 3.0.1
info:
  title: SlashID Groups Workflows API
  description: "This is the [OpenAPI](https://www.openapis.org/) specification for communicating with the [SlashID](https://www.slashid.dev/) service.\n\nThe latest version of the OpenAPI API spec can be fetched from [our CDN](https://cdn.slashid.com/slashid-openapi-latest.yaml).\n\nWe recommend you use an [OpenAPI SDK generator](https://openapi.tools/#sdk) to create a client library in your programming language,\nbut you can also use this documentation to make HTTP calls directly.\n\n> **Compatibility note**: We aim to keep wire compatibility whenever we update the API, but parts of the specification may occasionally be refactored.\n  If you use an SDK generator, your code may require minor changes between versions.\n"
  version: '1.1'
  termsOfService: https://www.slashid.dev/terms-of-use/
  contact:
    name: API Support
    email: contact@slashid.dev
servers:
- url: https://api.slashid.com
  description: Production
- url: https://api.sandbox.slashid.com
  description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Workflows
paths:
  /workflows:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Create a new workflow
      description: Creates a new workflow for automated response actions
      requestBody:
        description: Workflow creation request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCreateRequest'
            examples:
              critical_detections_workflow:
                summary: Workflow for critical detections
                description: Create a workflow with just name and description. Actions and data input can be added via UPDATE endpoint.
                value:
                  name: Critical Detection Response
                  description: Automated response workflow for critical severity detections
      responses:
        '201':
          description: Workflow created successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/Workflow'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '409':
          $ref: '#/components/responses/Conflict'
    get:
      operationId: GetWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflows
      description: Retrieve a list of workflows for the organization
      parameters:
      - name: status
        in: query
        description: Filter by workflow status
        schema:
          $ref: '#/components/schemas/WorkflowStatus'
      - name: limit
        in: query
        description: Maximum number of workflows to return
        schema:
          type: integer
          default: 50
          minimum: 1
          maximum: 100
      - name: offset
        in: query
        description: Offset for pagination
        schema:
          type: integer
          default: 0
          minimum: 0
      - name: sort
        in: query
        description: 'Sort parameter in format "field:order".

          Valid fields: created_at, updated_at, name.

          Valid orders: asc, desc.

          Example: "created_at:desc" (default)

          '
        schema:
          type: string
          example: created_at:desc
      - name: type
        in: query
        description: Filter by workflow data input type
        schema:
          $ref: '#/components/schemas/WorkflowDataInputType'
      responses:
        '200':
          description: List of workflows
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        workflows:
                          type: array
                          items:
                            $ref: '#/components/schemas/Workflow'
                      required:
                      - workflows
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /workflows/{workflow_id}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get workflow details
      description: 'Retrieve details of a specific workflow.

        When include_configuration=true, the response also includes the latest workflow configuration

        (data_input_config, actions, version, etc.).

        '
      parameters:
      - name: include_configuration
        in: query
        description: Include latest workflow configuration in response
        required: false
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Workflow details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      oneOf:
                      - $ref: '#/components/schemas/Workflow'
                      - $ref: '#/components/schemas/WorkflowWithConfiguration'
                      discriminator:
                        propertyName: kind
                        mapping:
                          workflow: '#/components/schemas/Workflow'
                          workflow_with_configuration: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Update workflow
      description: Update a workflow and create a new version
      requestBody:
        description: Workflow update request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowUpdateRequest'
      responses:
        '200':
          description: Workflow updated successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Delete workflow
      description: Soft delete a workflow (marks as deleted)
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflow versions
      description: Retrieve all versions of a workflow
      responses:
        '200':
          description: List of workflow versions
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        versions:
                          type: array
                          items:
                            $ref: '#/components/schemas/WorkflowConfiguration'
                      required:
                      - versions
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions/{version}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - name: version
      in: path
      required: true
      description: Workflow version number
      schema:
        type: integer
        minimum: 1
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersionsVersion
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get specific workflow version
      description: Retrieve a specific version of a workflow
      responses:
        '200':
          description: Workflow version details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostWorkflowsWorkflowIdVersionsVersionRestore
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Restore workflow version
      description: Restore a previous version of a workflow as the latest version
      responses:
        '200':
          description: Workflow version restored successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/activate:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdActivate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Activate workflow
      description: Activate a workflow to make it operational
      responses:
        '204':
          description: Workflow activated successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/pause:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdPause
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Pause workflow
      description: Pause an active workflow
      responses:
        '204':
          description: Workflow paused successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/resume:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdResume
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Resume workflow
      description: Resume a paused workflow
      responses:
        '204':
          description: Workflow resumed successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdExecute
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Execute workflow
      description: Manually trigger workflow execution
      responses:
        '204':
          description: Workflow execution triggered successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/scheduled-execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdScheduledExecute
      tags:
      - Workflows
      summary: Internal endpoint for scheduled workflow execution
      description: 'Internal endpoint invoked by the workflow scheduler (GCP Cloud Scheduler in production, the docker-scheduler in dev) on each cron tick. Publishes a workflow execute event with trigger_source=scheduled. Not intended for external callers.

        '
      responses:
        '200':
          description: Tick accepted (or skipped if the workflow is not active)
          content:
            application/json:
              schema:
                type: object
                properties:
                  skipped:
                    type: string
                  status:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/cypher-preview:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsCypherPreview
      tags:
      - Workflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Run a read-only Cypher query and return the first 50 rows
      description: 'Synchronous preview for the Query Workflows UI. Validates the query

        (same validator as scheduled runs), runs it against the caller''s org

        graph with a 10-second timeout and a hard 50-row cap. Read-only —

        write keywords are rejected. Not intended for batch use; use the

        scheduled-execute path for production reads.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCypherPreviewRequest'
      responses:
        '200':
          description: Preview results.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewResponse'
        '400':
          description: Validation error (query empty, missing MATCH/RETURN, write keyword, etc.).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
        '504':
          description: Query exceeded the 10-second preview timeout.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
components:
  schemas:
    Neo4jTemplatePredicate:
      type: object
      required:
      - kind
      - template
      properties:
        kind:
          type: string
          enum:
          - neo4j_template
        template:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
    WorkflowUpdateRequest:
      type: object
      properties:
        name:
          type: string
          description: New workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: New workflow description
          maxLength: 1000
        data_input_config:
          $ref: '#/components/schemas/WorkflowDataInputConfiguration'
          description: 'Updated data input configuration.

            If provided, creates a new version with new data retrieval settings.

            '
        actions:
          type: object
          description: 'Updated actions configuration. Map of action ID to action configuration.

            '
          additionalProperties:
            $ref: '#/components/schemas/WorkflowActionConfiguration'
        starting_actions:
          type: array
          description: 'IDs of actions to execute first after data input completes.

            Enables tree-based execution where only these actions start initially,

            and child actions are triggered via the children field.

            '
          items:
            type: string
    Predicate:
      oneOf:
      - $ref: '#/components/schemas/AndPredicate'
      - $ref: '#/components/schemas/OrPredicate'
      - $ref: '#/components/schemas/NotPredicate'
      - $ref: '#/components/schemas/ScimPredicate'
      - $ref: '#/components/schemas/PgQueryPredicate'
      - $ref: '#/components/schemas/PgTemplatePredicate'
      - $ref: '#/components/schemas/Neo4jQueryPredicate'
      - $ref: '#/components/schemas/Neo4jTemplatePredicate'
      - $ref: '#/components/schemas/EventCountOverWindowPredicate'
      discriminator:
        propertyName: kind
        mapping:
          and: '#/components/schemas/AndPredicate'
          or: '#/components/schemas/OrPredicate'
          not: '#/components/schemas/NotPredicate'
          scim: '#/components/schemas/ScimPredicate'
          pg_query: '#/components/schemas/PgQueryPredicate'
          pg_template: '#/components/schemas/PgTemplatePredicate'
          neo4j_query: '#/components/schemas/Neo4jQueryPredicate'
          neo4j_template: '#/components/schemas/Neo4jTemplatePredicate'
          event_count_over_window: '#/components/schemas/EventCountOverWindowPredicate'
    AndPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - and
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    NotificationActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - notification_type
        - recipients
        properties:
          notification_type:
            type: string
            enum:
            - email
            - slack
            - teams
            - pagerduty
            - sms
            description: Type of notification to send
          recipients:
            type: array
            items:
              type: string
            description: Notification recipients
            example:
            - security-team@example.com
            - '#security-alerts'
          subject_template:
            type: string
            description: Template for notification subject
          message_template:
            type: string
            description: Template for notification message
          severity:
            type: string
            enum:
            - info
            - warning
            - error
            - critical
            description: Notification severity level
            default: warning
          include_data:
            type: boolean
            description: Whether to include detection data in notification
            default: true
    WebhookActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - url
        - method
        properties:
          url:
            type: string
            format: uri
            description: Webhook endpoint URL
          method:
            type: string
            enum:
            - POST
            - PUT
            - PATCH
            description: HTTP method to use
            default: POST
          headers:
            type: object
            additionalProperties:
              type: string
            description: Custom headers to send
          body_template:
            type: string
            description: Template for request body
          timeout_seconds:
            type: integer
            description: Request timeout in seconds
            default: 30
            minimum: 1
            maximum: 300
          retry_config:
            type: object
            properties:
              max_retries:
                type: integer
                default: 3
                minimum: 0
                maximum: 10
              backoff_seconds:
                type: integer
                default: 5
                minimum: 1
    RemediationTargetType:
      type: string
      enum:
      - user
      - session
      - credential
      - api_key
      - group_membership
      - role
      - permission
      - entity
      - group
      description: Target of the remediation action
    WorkflowDataInputUarFindingConfiguration:
      type: object
      required:
      - type
      description: 'Filters which UarFindingV1 events this workflow should run on.

        In v1 the only emitted trigger is `manual`; other trigger values

        (decision_revoked, decision_effective, level_completed,

        campaign_completed) are accepted for forward-compat with the

        auto-trigger work but never match an event until those triggers

        ship. Backed by

        backend/modules/workflows/entities/workflow_data_input_uar_finding_configuration.go.

        '
      properties:
        type:
          type: string
          enum:
          - uar_finding
          description: Data input type discriminator
        triggers:
          type: array
          items:
            type: string
          description: 'UarFindingV1 trigger reasons that fire this workflow (ANY

            match). Defaults to `["manual"]` when empty.

            '
        campaign_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by specific campaign IDs. Empty matches all.
        campaign_template_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by campaign template IDs. Empty matches all.
        campaign_types:
          type: array
          items:
            type: string
          description: 'Filter by campaign type (e.g. `user`, `resource`,

            `non_human_identity`). Empty matches all.

            '
        classification_tags:
          type: array
          items:
            type: string
          description: Filter by classification tags on the finding. Empty matches all.
        outcomes:
          type: array
          items:
            type: string
          description: Filter by reviewer decision outcome (e.g. `approve`, `revoke`). Empty matches all.
        only_effective:
          type: boolean
          default: false
          description: 'Match only when `effective_outcome == outcome` — the decision

            survived multi-tier escalation rather than being overridden.

            '
        min_level:
          type: integer
          minimum: 0
          description: Filter by decision level >= this value.
        only_high_privilege:
          type: boolean
          default: false
          description: Restrict to findings flagged as high-privilege.
        user_source_types:
          type: array
          items:
            type: string
          description: Filter by user identity source type. Empty matches all.
        user_entity_types:
          type: array
          items:
            type: string
          description: Filter by user entity type. Empty matches all.
        asset_source_types:
          type: array
          items:
            type: string
          description: Filter by asset source type. Empty matches all.
        asset_entity_types:
          type: array
          items:
            type: string
          description: Filter by asset entity type. Empty matches all.
        granting_entity_types:
          type: array
          items:
            type: string
          description: Filter by granting entity type (e.g. role, group). Empty matches all.
        scim_filter:
          type: string
          description: 'Optional SCIM-style filter over the flattened finding payload,

            applied after the structured filters above.

            '
    WorkflowActionType:
      type: string
      enum:
      - remediation
      - ticket
      - data_sink
      - webhook
      - notification
      - condition
      description: Type of workflow action
    Workflow:
      type: object
      required:
      - kind
      - id
      - org_id
      - name
      - status
      - created_by
      - created_at
      - updated_by
      - updated_at
      - execution_count
      - success_count
      - failure_count
      - latest_configuration_version
      properties:
        kind:
          type: string
          enum:
          - workflow
          - workflow_with_configuration
          description: 'Discriminator for the GET /workflows/{id} response variant.

            `workflow` is returned when `include_configuration=false`;

            `workflow_with_configuration` when the latest version is bundled

            into the response. The enum lists both values intentionally so

            the schema composition `WorkflowWithConfiguration = allOf

            [Workflow, WorkflowConfiguration]` doesn''t produce an

            unsatisfiable enum constraint; the discriminator on the

            endpoint''s `oneOf` does the runtime dispatch. Required so the

            typescript-fetch generator emits switch-based dispatch (needed

            since openapi-generator-cli v7 — see PR #5928) instead of

            order-sensitive `instanceOf` checks that silently drop the

            configuration fields when both schemas overlap.

            '
        id:
          type: string
          description: Unique workflow identifier
        org_id:
          type: string
          description: Organization ID
        name:
          type: string
          description: Workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: Workflow description
          maxLength: 1000
        status:
          $ref: '#/components/schemas/WorkflowStatus'
        created_by:
          type: string
          description: User ID who created the workflow
        created_at:
          type: string
          format: date-time
          description: Workflow creation timestamp
        updated_by:
          type: string
          description: User ID who last updated the workflow
        updated_at:
          type: string
          format: date-time
          description: Last update timestamp
        activated_at:
          type: string
          format: date-time
          description: When workflow was first activated
        paused_at:
          type: string
          format: date-time
          description: When workflow was paused
        last_executed_at:
          type: string
          format: date-time
          description: Last execution timestamp
        execution_count:
          type: integer
          description: Total execution count
          minimum: 0
        success_count:
          type: integer
          description: Successful execution count
          minimum: 0
        failure_count:
          type: integer
          description: Failed execution count
          minimum: 0
        latest_configuration_id:
          type: string
          description: ID of the latest configuration version
        latest_configuration_version:
          type: integer
          description: Latest configuration version number
          minimum: 0
    WorkflowActionConfiguration:
      oneOf:
      - $ref: '#/components/schemas/RemediationActionConfiguration'
      - $ref: '#/components/schemas/TicketActionConfiguration'
      - $ref: '#/components/schemas/DataSinkActionConfiguration'
      - $ref: '#/components/schemas/WebhookActionConfiguration'
      - $ref: '#/components/schemas/NotificationActionConfiguration'
      - $ref: '#/components/schemas/ConditionActionConfiguration'
      discriminator:
        propertyName: type
        mapping:
          remediation: '#/components/schemas/RemediationActionConfiguration'
          ticket: '#/components/schemas/TicketActionConfiguration'
          data_sink: '#/components/schemas/DataSinkActionConfiguration'
          webhook: '#/components/schemas/WebhookActionConfiguration'
          notification: '#/components/schemas/NotificationActionConfiguration'
          condition: '#/components/schemas/ConditionActionConfiguration'
    ParamValue:
      type: object
      description: Exactly one of literal or path must be set.
      properties:
        literal: {}
        path:
          type: string
          description: JSONPath expression resolved against the WorkflowDataItem at evaluation time.
    OrPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - or
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    APIResponseBase:
      type: object
      properties:
        meta:
          $ref: '#/components/schemas/APIMeta'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/APIResponseError'
    EventCountSource:
      oneOf:
      - $ref: '#/components/schemas/PgDetectionSource'
      - $ref: '#/components/schemas/BigQueryAnalyticsSource'
      discriminator:
        propertyName: kind
        mapping:
          pg_detection: '#/components/schemas/PgDetectionSource'
          bigquery_analytics: '#/components/schemas/BigQueryAnalyticsSource'
    WorkflowDataInputConfiguration:
      oneOf:
      - $ref: '#/components/schemas/WorkflowDataInputDetectionConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputLifecycleConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputUarFindingConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputCypherConfiguration'
      discriminator:
        propertyName: type
        mapping:
          detection: '#/components/schemas/WorkflowDataInputDetectionConfiguration'
          lifecycle: '#/components/schemas/WorkflowDataInputLifecycleConfiguration'
          uar_finding: '#/components/schemas/WorkflowDataInputUarFindingConfiguration'
          cypher_query: '#/components/schemas/WorkflowDataInputCypherConfiguration'
    APIPagination:
      type: object
      required:
      - limit
      - offset
      - total_count
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total_count:
          type: integer
          format: int64
    WorkflowCypherPreviewResponse:
      type: object
      required:
      - columns
      - rows
      - duration_ms
      - truncated
      properties:
        columns:
          type: array
          items:
            type: string
          description: Column names in declared order.
        rows:
          type: array
          items:
            type: array
            items: {}
          description: Row values, parallel to `columns`. Cell values are arbitrary JSON.
        duration_ms:
          type: integer
          minimum: 0
          description: Server-measured query duration in milliseconds.
        truncated:
          type: boolean
          description: True when the query returned more than the preview cap (50 rows).
    PgTemplatePredicate:
      type: object
      required:
      - kind
      - template
      properties:
        kind:
          type: string
          enum:
          - pg_template
        template:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
    EventCountOverWindowPredicate:
      type: object
      required:
      - kind
      - source
      - window
      - operator
      - threshold
      properties:
        kind:
          type: string
          enum:
          - event_count_over_window
        source:
          $ref: '#/components/schemas/EventCountSource'
        window:
          type: string
          example: 1h
          description: Duration string (e.g. "1h", "24h", "7d").
        operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        threshold:
          type: integer
          format: int64
          minimum: 0
    PgDetectionSource:
      type: object
      required:
      - kind
      - match
      properties:
        kind:
          type: string
          enum:
          - pg_detection
        match:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
    WorkflowCreateRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: Workflow description
          maxLength: 1000
    WorkflowStatus:
      type: string
      enum:
      - draft
      - active
      - paused
      - deleted
      description: Current state of a workflow
    WorkflowWithConfiguration:
      allOf:
      - $ref: '#/components/schemas/Workflow'
      - $ref: '#/components/schemas/WorkflowConfiguration'
    Neo4jQueryPredicate:
      type: object
      required:
      - kind
      - cypher
      properties:
        kind:
          type: string
          enum:
          - neo4j_query
        cypher:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
        timeout_sec:
          type: integer
          minimum: 0
          maximum: 30
    APICursorPagination:
      type: object
      required:
      - limit
      - cursor
      - total_count
      properties:
        limit:
          type: integer
        cursor:
          type: string
        total_count:
          type: integer
          format: int64
    RemediationActionType:
      type: string
      enum:
      - suspend
      - quarantine
      - delete
      - rotate
      - revoke
      - remove_from
      - enable
      - add_to
      - update_permissions
      - force_mfa
      description: Type of remediation action to perform
    WorkflowDataInputDetectionConfiguration:
      type: object
      required:
      - type
      - scim_filter
      properties:
        type:
          type: string
          enum:
          - detection
          description: Data input type discriminator
        scim_filter:
          type: string
          description: "SCIM filter string to apply when querying detections.\nExamples:\n  - `severity eq \"critical\"`\n  - `type eq \"aws_identity_unused\" and status eq \"new\"`\n  - `entity_type eq \"aws_iam_user\"`\n  - `severity eq \"critical\" or severity eq \"high\"`\n"
          minLength: 1
          example: severity eq "critical"
        limit:
          type: integer
          description: Maximum number of detections to retrieve (0 for no limit)
          default: 0
          minimum: 0
          maximum: 10000
        sorting:
          type: array
          description: Sorting configuration for results
          items:
            type: object
            required:
            - field
            - direction
            properties:
              field:
                type: string
                description: Field to sort by
                example: created_at
              direction:
                type: string
                enum:
                - asc
                - desc
                description: Sort direction
                default: desc
    DataSinkActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - sink_type
        properties:
          sink_type:
            type: string
            enum:
            - s3
            - gcs
            - bigquery
            - snowflake
            - splunk
            - elasticsearch
            description: Target data sink type
          connection_config:
            type: object
            additionalProperties: true
            description: Connection configuration for the data sink
          data_format:
            type: string
            enum:
            - json
            - csv
            - parquet
            description: Format for exported data
            default: json
          include_fields:
            type: array
            items:
              type: string
            description: Fields to include in export
          transform_rules:
            type: array
            items:
              type: object
            description: Data transformation rules
    WorkflowCypherPreviewRequest:
      type: object
      required:
      - query
      properties:
        query:
          type: string
          minLength: 1
          maxLength: 10000
          description: Read-only Cypher query to execute against the org's graph.
          example: MATCH (u:User) WHERE u.active = true RETURN u.id, u.email
        parameters:
          type: object
          additionalProperties: true
          description: Parameters bound into the query (same as scheduled config).
    ConditionActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - type
        - predicate
        - on_true
        properties:
          type:
            type: string
            enum:
            - condition
          predicate:
            $ref: '#/components/schemas/Predicate'
          on_true:
            type: array
            items:
              type: string
            minItems: 1
            description: Action IDs to run for items where the predicate evaluates to true.
          on_false:
            type: array
            items:
              type: string
            description: 'Action IDs to run for items where the predicate evaluates to false.

              If empty, items routed to this branch are dropped from the subtree.

              '
          debug:
            type: boolean
            default: false
            description: When true, the evaluator emits per-leaf traces into ResultData.
    WorkflowDataInputCypherConfiguration:
      type: object
      required:
      - type
      - query
      properties:
        type:
          type: string
          enum:
          - cypher_query
          description: Data input type discriminator
        query:
          type: string
          description: 'Read-only Cypher query whose rows feed downstream workflow actions.

            Must contain MATCH and RETURN clauses. Write operations and the

            USE clause are rejected by the validator. Comments and strings are

            tokenized before validation, so a write keyword inside a string

            literal is allowed.

            '
          minLength: 1
          maxLength: 10000
          example: MATCH (u:User) WHERE u.active = true RETURN u.id, u.email
        parameters:
          type: object
          additionalProperties: true
          description: 'Parameters bound into the query at execution time. Keys must match

            the `$name` placeholders in `query`. Values are passed verbatim to

            the Neo4j driver.

            '
          example:
            min_age: 7
        max_rows:
          type: integer
          description: 'Maximum rows returned by a scheduled execution (NOT the preview).

            Capped server-side at 10000.

            '
          default: 1000
          minimum: 1
          maximum: 10000
        timeout_seconds:
          type: integer
          description: 'Per-execution query timeout (NOT the preview). Capped server-side

            at 300.

            '
          default: 30
          minimum: 1
          maximum: 300
        on_limit_exceeded:
          type: string
          enum:
          - fail
          - truncate
          default: fail
          description: 'Behavior when the query returns more than `max_rows`. `fail` aborts

            the execution with an error; `truncate` returns the first

            `max_rows` rows and marks the execution as truncated.

            '
        primary_entity_column:
          type: string
          description: 'Optional. Name of a query result column whose value is the primary

            entity ID for each row. When set, downstream remediation actions

            can target this entity. Must match one of the column aliases in

            the query''s RETURN clause.

            '
          example: u.id
    BaseActionConfiguration:
      type: object
      required:
      - id
      - type
      - enabled
      properties:
        id:
          type: string
          description: Unique identifier for this action
        type:
          $ref: '#/components/schemas/WorkflowActionType'
        name:
          type: string
          description: Human-readable name for this action
        description:
          type: string
          description: Description of what this action does
        enabled:
          type: boolean
          description: Whether this action is enabled
          default: true
        integration_id:
          type: string
          description: Optional integration ID to use for this action (e.g., specific ticketing system integration)
        children:
          type: array
          description: IDs of child actions to execute after this action completes
          items:
            type: string
          default: []
    ScimPredicate:
      type: object
      required:
      - kind
      - filter
      properties:
        kind:
          type: string
          enum:
          - scim
        filter:
          type: string
          description: SCIM 2.0 filter string evaluated in-memory against the WorkflowDataItem.
    APIResponseError:
      type: object
      properties:
        httpcode:
          type: integer
        message:
          type: string
    WorkflowCypherPreviewError:
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
          description: Stable error code (see backend cypher validator sentinels).
          example: cypher_write_keyword
        message:
          type: string
          description: Human-readable detail. May reference server-side context.
    WorkflowDataInputType:
      type: string
      enum:
      - detection
      - lifecycle
      - uar_finding
      - cypher_query
      description: Type of data input for workflow
    WorkflowConfiguration:
      type: object
      required:
      - id
      - workflow_id
      - org_id
      - version
      - data_input_config
      - actions
      - created_by
      - created_at
      - is_latest
      properties:
        id:
          type: string
          description: Unique configuration identifier
        workflow_id:
          type: string
          description: Parent workflow ID
        org_id:
          type: string
          description: Organization ID
        version:
          type: integer
          description: Configuration version number
          minimum: 1
        data_input_config:
          $ref: '#/components/schemas/WorkflowDataInputConfiguration'
          description: "Configuration for retrieving and filtering data that triggers workflow actions.\n Defines what data to query and how to filter it.\n"
        actions:
          type: object
          description: 'Actions configuration. Map of action ID to action configuration.

            '
          additionalProperties:
            $ref: '#/components/schemas/WorkflowActionConfiguration'
        starting_actions:
          type: array
          description: 'IDs of actions to execute first (after data input).

            '
          items:
            type: string
        schedule:
          type: string
          description: 'Optional cron expression (5-field, UTC). When non-empty, the

            workflow is registered with the scheduler and fires on each tick

            (cron parser: github.com/hashicorp/cronexpr). Must be empty when

            `data_input_config.type` is `lifecycle` — lifecycle workflows are

            event-driven and cannot be scheduled.

            '
          example: 0 9 * * *
        created_by:
          type: string
          description: User ID who created this version
        created_at:
          type: string
          format: date-time
          description: Version creation timestamp
        is_latest:
          type: boolean
          description: Whether this is the latest version
    TicketActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - ticket_system
        properties:
          ticket_system:
            type: string
            enum:
            - jira
            - servicenow
            - linear
            - github
            description: Target ticket system
          project_key:
            type: string
            description: Project or board identifier
          issue_type:
            type: string
            description: Type of ticket to create
            example: Incident
          title_template:
            type: string
            description: Template for ticket title
            example: 'Security Alert: {{detection.name}}'
          description_template:
            type: string
            description: Template for ticket description
          labels:
            type: array
            items:
              type: string
            description: Labels to apply to the ticket
          assignee:
            type: string
            description: Default assignee for the ticket
          priority:
            type: string
            description: Ticket priority
            example: High
    APIMeta:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/APIPagination'
        cursor_pagination:
          $ref: '#/components/schemas/APICursorPagination'
    BigQueryAnalyticsSource:
      type: object
      required:
      - kind
      - view
      - match
      properties:
        kind:
          type: string
          enum:
          - bigquery_analytics
        view:
          type: string
          description: Fully-qualified BigQuery view name (project.dataset.view).
        match:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        staleness_ok_seconds:
          type: integer
          minimum: 0
          default: 300
    WorkflowDataInputLifecycleConfiguration:
      type: object
      required:
      - type
      - event_types
      properties:
        type:
          type: string
          enum:
          - lifecycle
          description: Data input type discriminator
        event_types:
          type: array
          items:
            $ref: '#/components/schemas/LifecycleEventType'
          minItems: 1
          description: Lifecycle events that trigger this workflow
          example:
          - created
          - deleted
        entity_types:
          type: array
          items:
            type: string
          description: Filter by entity types (e.g., aws_iam_user, entra_user). If empty, all entity types are matched.
          example:
          - aws_iam_user
          - entra_user
        source_types:
          type: array
          items:
            type: string
          description: Filter by identity source types (e.g., aws_account, entra). If empty, all source types are matched.
          example:
          - aws_account
          - entra
        connection_ids:
          type: array
          items:
            type: string
          description: Filter by specific connection IDs. If empty, all connections are matched.
        min_risk_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Only trigger for entities with risk score >= this value
        max_risk_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Only trigger for entities with risk score <= this value
        include_relationships:
          type: boolean
          default: false
          description: Fetch manager, groups, direct reports from Neo4j
        include_permissions:
          type: boolean
          default: false
          description: Fetch permission assignments from Neo4j
        include_access_history:
          type: boolean
          default: false
          description: Fetch recent access records from Neo4j
        relationship_depth:
          type: integer
          minimum: 0
          maximum: 3
          default: 1
          description: How deep to traverse relationships in Neo4j (default 1, max 3)
        scim_filter:
          type: string
          description: Additional SCIM-style filter criteria for the entity
    LifecycleEventType:
      type: string
      enum:
      - created
      - deleted
      - suspended
      - modified
      - reactivated
      - role_changed
      - group_added
      - group_removed
      - risk_score_changed
      - inactive_threshold
      description: 'Type of user lifecycle event that triggers the workflow.

        Phase 1 (Core): created, deleted, suspended

        Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

        '
    PgQueryPredicate:
      type: object
      required:
      - kind
      - sql
      properties:
        kind:
          type: string
          enum:
          - pg_query
        sql:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
          description: For bool-returning queries — matches this value.
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
        timeout_sec:
          type: integer
          minimum: 0
          maximum: 30
    NotPredicate:
      type: object
      required:
      - kind
      - predicate
      properties:
        kind:
          type: string
          enum:
          - not
        predicate:
          $ref: '#/components/schemas/Predicate'
    RemediationActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - action
        - target_type
        properties:
          action:
            $ref: '#/components/schemas/RemediationActionType'
          target_type:
            $ref: '#/components/schemas/RemediationTargetType'
          parameters:
            type: object
            additionalProperties: true
            description: Action-specific parameters
            example:
              group_name: suspended_users
              reason: Suspicious activity detected
          dry_run:
            type: boolean
            description: If true, action is simulated but not executed (logs what would happen)
            default: false
  parameters:
    OrgIDHeader:
      name: SlashID-OrgID
      in: header
      schema:
        type: string
      required: true
      description: The organization ID
      example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
  responses:
    NoContent:
      description: No content
    NotFound:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    Conflict:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
  securitySchemes:
    ApiKeyAuth:
      description: Authorizes the request with the organization's API Key.
      x-svc-um-api: true
      type: apiKey
      in: header
      name: SlashID-API-Key
    OAuth2ClientIdSecret:
      description: Authorizes the request with a client ID/client secret pair
      type: http
      scheme: basic
    OAuth2AccessTokenBearer:
      description: Authorizes the request with an Access Token for the current user.
      type: http
      scheme: bearer
      bearerFormat: opaque