workflows
Saved signing workflow templates.
| Method | Path | Operation ID |
|---|---|---|
| GET | /v1/workflow-templates |
listWorkflowTemplates |
| POST | /v1/workflow-templates |
createWorkflowTemplate |
| GET | /v1/workflow-templates/{template_id} |
getWorkflowTemplate |
| PUT | /v1/workflow-templates/{template_id} |
replaceWorkflowTemplate |
| DELETE | /v1/workflow-templates/{template_id} |
deleteWorkflowTemplate |
GET /v1/workflow-templates
Section titled “GET /v1/workflow-templates”Operation ID: listWorkflowTemplates
List the account’s saved signing workflow templates.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json WorkflowTemplateListResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
data |
array of WorkflowTemplateResponse | yes |
POST /v1/workflow-templates
Section titled “POST /v1/workflow-templates”Operation ID: createWorkflowTemplate
Save a signing workflow template from ordered builder blocks.
Save a workflow. Refused combinations are 422 WORKFLOW_TEMPLATE_INVALID with detail_code AI_DECLARATION_REQUIRES_SIGN_ONLY or IDENTITY_CREDENTIAL_NOT_ENROLLED; a duplicate name is 409 WORKFLOW_TEMPLATE_CONFLICT.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: WorkflowTemplateRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
blocks |
array of UploadBlock or WatermarkBlock or FingerprintBlock or AiMarkBlock or CawgIdentityBlock or SignBlock or VerifyBlock or WebhookBlock or DisclosureEventBlock | yes | In pipeline order: upload, watermark, fingerprint, ai_mark, cawg_identity, sign, verify, webhook, disclosure_event. upload and sign are required; each block at most once. ai_mark with watermark, and cawg_identity before an identity certificate is enrolled, are refused exactly as POST /v1/sign refuses them. |
description |
string or null | no | |
name |
string | yes | Unique within the account. Max length 80. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json WorkflowTemplateResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
blocks |
array of UploadBlock or WatermarkBlock or FingerprintBlock or AiMarkBlock or CawgIdentityBlock or SignBlock or VerifyBlock or WebhookBlock or DisclosureEventBlock | yes | |
created_at |
string | yes | |
description |
string or null | yes | |
name |
string | yes | |
schema_version |
const “op.workflow-template.v1” | yes | |
sign_request |
WorkflowSignRequestFields | yes | The POST /v1/sign fields (all but asset_id) the blocks stand for. Read-only. |
template_id |
string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
updated_at |
string | yes | |
version |
integer | yes |
GET /v1/workflow-templates/{template_id}
Section titled “GET /v1/workflow-templates/{template_id}”Operation ID: getWorkflowTemplate
Read one tenant-owned workflow template and its derived sign request.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
template_id |
path | string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json WorkflowTemplateResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
blocks |
array of UploadBlock or WatermarkBlock or FingerprintBlock or AiMarkBlock or CawgIdentityBlock or SignBlock or VerifyBlock or WebhookBlock or DisclosureEventBlock | yes | |
created_at |
string | yes | |
description |
string or null | yes | |
name |
string | yes | |
schema_version |
const “op.workflow-template.v1” | yes | |
sign_request |
WorkflowSignRequestFields | yes | The POST /v1/sign fields (all but asset_id) the blocks stand for. Read-only. |
template_id |
string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
updated_at |
string | yes | |
version |
integer | yes |
PUT /v1/workflow-templates/{template_id}
Section titled “PUT /v1/workflow-templates/{template_id}”Operation ID: replaceWorkflowTemplate
Replace one workflow template under its expected version.
Replace a workflow; a stale expected_version is 409 WORKFLOW_TEMPLATE_CONFLICT.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
template_id |
path | string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
Request body
Section titled “Request body”application/json: WorkflowTemplateReplaceRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
blocks |
array of UploadBlock or WatermarkBlock or FingerprintBlock or AiMarkBlock or CawgIdentityBlock or SignBlock or VerifyBlock or WebhookBlock or DisclosureEventBlock | yes | In pipeline order: upload, watermark, fingerprint, ai_mark, cawg_identity, sign, verify, webhook, disclosure_event. upload and sign are required; each block at most once. ai_mark with watermark, and cawg_identity before an identity certificate is enrolled, are refused exactly as POST /v1/sign refuses them. |
description |
string or null | no | |
expected_version |
integer | yes | The version you read. Minimum 1. |
name |
string | yes | Unique within the account. Max length 80. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json WorkflowTemplateResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
blocks |
array of UploadBlock or WatermarkBlock or FingerprintBlock or AiMarkBlock or CawgIdentityBlock or SignBlock or VerifyBlock or WebhookBlock or DisclosureEventBlock | yes | |
created_at |
string | yes | |
description |
string or null | yes | |
name |
string | yes | |
schema_version |
const “op.workflow-template.v1” | yes | |
sign_request |
WorkflowSignRequestFields | yes | The POST /v1/sign fields (all but asset_id) the blocks stand for. Read-only. |
template_id |
string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
updated_at |
string | yes | |
version |
integer | yes |
DELETE /v1/workflow-templates/{template_id}
Section titled “DELETE /v1/workflow-templates/{template_id}”Operation ID: deleteWorkflowTemplate
Delete one tenant-owned workflow template.
Delete a workflow. Jobs already admitted from it are unaffected.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
template_id |
path | string | yes | Pattern: ^wft_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 204 | Successful Response | none |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |