Cisco XDR Workflow Instances API
The WorkflowInstances API from Cisco XDR — 7 operation(s) for workflowinstances.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cisco-xdr-workflowinstances-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: REST API. Workflow Instances API
version: 1.0.0
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: visibility.amp.cisco.com
note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine.
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json
- type: source
url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: https://automate.us.security.cisco.com/{basePath}
variables:
basePath:
default: api
security:
- oAuth2:
- integration:read
- private-intel:read
- profile:read
- inspect:read
- users:read
- invite:read
- enrich:read
- oauth:read
- response:read
- global-intel:read
- ao:read
- playbook:read
tags:
- name: WorkflowInstances
paths:
/v1.1/instances:
post:
tags:
- WorkflowInstances
summary: Handler to get all Workflow Instances.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: getAllWorkflowInstancesQueryParams
parameters:
- name: state
in: query
description: The state of workflow.
schema:
type: string
x-go-name: State
x-go-name: State
- name: search
in: query
description: The search term to filter workflow by workflow display name
schema:
type: string
x-go-name: Search
x-go-name: Search
- name: start
in: query
description: Start return list of instances from the number specified
schema:
type: integer
format: uint8
x-go-name: Start
x-go-name: Start
- name: limit
in: query
description: Number of workflow instances will return by this request, must between 0-100
required: true
schema:
type: integer
format: uint8
x-go-name: Limit
x-go-name: Limit
- name: date_from
in: query
description: Return instances that started on after this date or on this date, example date is 2019-05-19T00:00:00Z
required: true
schema:
type: string
format: date-time
x-go-name: DateFrom
x-go-name: DateFrom
- name: date_to
in: query
description: Return instances that are started on before this date or on this date, example date is 2019-05-19T00:00:00Z
schema:
type: string
format: date-time
x-go-name: DateTo
x-go-name: DateTo
requestBody:
description: An request body to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowsInstancePostRequest'
required: false
x-go-name: RequestBody
responses:
'200':
description: 'An WFInstanceResponse response model
# This is used for returning a response with a workflow instance as body'
content:
application/json:
schema:
$ref: '#/components/schemas/WFInstancePaginationResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/instances:
get:
tags:
- WorkflowInstances
summary: Handler to get all Workflow Instances.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: listWorkflowInstancesV1
parameters:
- name: workflow_id
in: query
description: An ID of workflow.
required: true
schema:
type: string
x-go-name: WoprkflowID
x-go-name: WoprkflowID
responses:
'200':
description: 'An WFInstanceResponseV1 response model
# This is used for returning a response with a workflow instance as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/WorkflowInstanceGetAllResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/instances/remove:
post:
tags:
- WorkflowInstances
summary: Handler to delete workflow instances in a batch.
description: 'Allowed Role(s): admin'
operationId: WorkflowInstanceBatchDeletePostRequest
parameters:
- name: state
in: query
description: Comma separated list of The state of instance.
schema:
type: string
x-go-name: State
x-go-name: State
- name: date_from
in: query
description: Return instances that started on after this date or on this date, example date is 2019-05-19T00:00:00Z
schema:
type: string
format: date-time
x-go-name: DateFrom
x-go-name: DateFrom
- name: date_to
in: query
description: Return instances that are started on before this date or on this date, example date is 2019-05-19T00:00:00Z
schema:
type: string
format: date-time
x-go-name: DateTo
x-go-name: DateTo
requestBody:
description: 'workflow instance IDs for deleting the specified instances in the list or workflow definition ID for deleting
the instances associated with the workflow'
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowInstanceBatchDeletePostReq'
required: true
x-go-name: RequestBody
responses:
'202':
description: 'An WorkflowInstanceDeleteResponse response model
# Returns message not marked for deletion if workflow instances are in running state'
headers:
message:
schema:
type: string
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'409':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/instances/summary:
get:
tags:
- WorkflowInstances
summary: Handler to get a summary of workflows instances.
description: 'Including total number of instances, total number of canceled, failed, running and successful instances
Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to workflow'
operationId: instancesSummaryQueryParam
parameters:
- name: workflow_id
in: query
schema:
type: string
x-go-name: WorkflowID
x-go-name: WorkflowID
responses:
'200':
description: 'An GetInstancesSummaryResponse model.
# It will return a summary of workflows'
content:
application/json:
schema:
$ref: '#/components/schemas/instancesSummaryResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/instances/{wf_instance_id}:
get:
tags:
- WorkflowInstances
summary: Handler returning workflow instance information.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: getWFInstanceById
parameters:
- name: wf_instance_id
in: path
description: The Id of worklfow instance
required: true
schema:
type: string
x-go-name: WFInstanceID
x-go-name: WFInstanceID
- name: detailed
in: query
description: 'Whether to return all block instances for an instance if it has blocks
If false, will only return first block instance and a block count'
schema:
type: boolean
x-go-name: Detailed
x-go-name: Detailed
responses:
'200':
description: 'An WorkflowInstanceResponse response model
# This is used for returning a response of workflow instance as body'
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowInstanceGetResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
post:
tags:
- WorkflowInstances
summary: Handler to manage(cancel/pause/resume) a specific workflow instance
description: 'Allowed Role(s): admin, user
Allowed User(s): Who have RUN permission to given workflow'
operationId: ManageWFInstanceByID
parameters:
- name: wf_instance_id
in: path
description: The Id of worklfow instance
required: true
schema:
type: string
x-go-name: WFInstanceID
x-go-name: WFInstanceID
- name: cancel
in: query
description: True for canceling an running/created status instance
schema:
type: boolean
x-go-name: Cancel
x-go-name: Cancel
- name: pause
in: query
description: True for pause an instance has running status
schema:
type: boolean
x-go-name: Pause
x-go-name: Pause
- name: resume
in: query
description: True for resume an instance has paused status
schema:
type: boolean
x-go-name: Resume
x-go-name: Resume
- name: rerun
in: query
description: True for run an instance has failed status
schema:
type: boolean
x-go-name: ReRun
x-go-name: ReRun
responses:
'200':
description: 'An ManageInstanceResponse response model
# Return instance status'
headers:
status:
schema:
type: string
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
delete:
tags:
- WorkflowInstances
summary: Handler for delete workflow instance.
description: 'Allowed Role(s): admin
Allowed User(s): Who have MANAGE permission to given workflow'
operationId: deleteWFInstanceById
parameters:
- name: wf_instance_id
in: path
description: The Id of worklfow instance
required: true
schema:
type: string
x-go-name: WFInstanceID
x-go-name: WFInstanceID
responses:
'202':
description: 'An WorkflowInstanceDeleteResponse response model
# Returns message not marked for deletion if workflow instances are in running state'
headers:
message:
schema:
type: string
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/instances/{wf_instance_id}/actions/{action_instance_id}:
get:
tags:
- WorkflowInstances
summary: Handler returning information about action's instance.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: getWFActionInstanceById
parameters:
- name: wf_instance_id
in: path
description: The Id of worklfow instance
required: true
schema:
type: string
x-go-name: WFInstanceID
x-go-name: WFInstanceID
- name: action_instance_id
in: path
description: The Id of worklfow action instance
required: true
schema:
type: string
x-go-name: WFActionInstanceID
x-go-name: WFActionInstanceID
- name: iteration
in: query
description: Iteration number for block instance if it has blocks
schema:
type: integer
format: uint64
x-go-name: Iteration
x-go-name: Iteration
responses:
'200':
description: 'An WorkflowActionInstanceResponse response model
# This is used for returning a response of action instance as body'
content:
application/json:
schema:
$ref: '#/components/schemas/ActionInstanceGetResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/instances/{wf_instance_id}/cancel:
post:
tags:
- WorkflowInstances
summary: '# Handler to cancel a specific workflow instance'
description: 'Allowed Role(s): admin, user
Allowed User(s): Who have RUN permission to given workflow'
operationId: CancelWFInstanceByID
parameters:
- name: wf_instance_id
in: path
description: The Id of worklfow instance
required: true
schema:
type: string
x-go-name: WFInstanceID
x-go-name: WFInstanceID
responses:
'200':
description: 'An CancelInstanceGetResponse response model
# Return cancel instance operation status'
headers:
status:
schema:
type: string
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
components:
schemas:
ActionTableInfo:
title: ActionTableInfo ..
type: object
properties:
table_id:
type: string
x-go-name: TableID
table_obj_type:
$ref: '#/components/schemas/LHObjType'
table_type_id:
type: string
x-go-name: TableTypeID
table_type_obj_type:
$ref: '#/components/schemas/LHObjType'
variable_id:
type: string
x-go-name: VariableID
variable_scope:
type: string
x-go-name: VariableScope
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
OutputInfo:
title: OutputInfo ..
type: object
properties:
items:
$ref: '#/components/schemas/ActionOutputVariable'
name:
type: string
x-go-name: Name
type:
type: string
x-go-name: Type
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
WorkflowInstanceGetResponse:
title: WorkflowInstanceGetResponse ...
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/ActionInstanceGetAllResponse'
x-go-name: Actions
base_type:
type: string
x-go-name: BaseType
categories:
type: array
items:
type: string
x-go-name: Categories
created_by:
type: string
x-go-name: CreatedBy
created_on:
type: string
format: date-time
x-go-name: CreatedOn
definition_id:
type: string
x-go-name: DefinitionID
description:
type: string
x-go-name: Description
dynamic_map:
$ref: '#/components/schemas/DynamicMap'
ended_on:
type: string
format: date-time
x-go-name: EndedOn
id:
type: string
x-go-name: InstanceID
name:
type: string
x-go-name: Name
output:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: Output
owner:
type: string
x-go-name: Owner
properties:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: Properties
root_workflow_id:
type: string
x-go-name: RootWorkflowID
schema_id:
type: string
x-go-name: ViewSchemaID
started_by:
type: string
x-go-name: StartedBy
started_on:
type: string
format: date-time
x-go-name: StartedOn
status:
$ref: '#/components/schemas/Status'
title:
type: string
x-go-name: Title
type:
type: string
x-go-name: Type
ui_config:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: UIConfig
updated_by:
type: string
x-go-name: UpdatedBy
updated_on:
type: string
format: date-time
x-go-name: UpdatedOn
variables:
type: array
items:
$ref: '#/components/schemas/Variable'
x-go-name: WFVariables
version:
type: string
x-go-name: Version
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/be-console/models
VariableContent:
title: VariableContent ...
type: object
properties:
description:
type: string
description: Description of variable
x-go-name: Description
display_on_wizard:
type: boolean
description: 'Should the variable be shown on wizard
Used in input scope variables, if it is true, then variable is displayed on wizard'
x-go-name: DisplayOnWizard
is_invisible:
type: boolean
x-go-name: IsInvisible
is_required:
type: boolean
description: 'Is the variable Required
Used in input string and secure string variable, if it is true, then string can''t be emptly'
x-go-name: IsRequired
name:
type: string
description: Name of variable
x-go-name: Name
scope:
type: string
description: Scope of variable. Scope can be 'input', 'global', 'local', 'static' or 'workflow'
x-go-name: Scope
type:
type: string
description: Type of variable. Type can be 'datatype.boolean', 'datatype.string', 'datatype.number' or 'datatype.table'
x-go-name: Type
value:
type: object
properties: {}
description: Value of variable. Value can be a string, boolean, number or array
x-go-name: Value
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/ao-libs/api/models
Status:
title: Status ...
type: object
properties:
details:
$ref: '#/components/schemas/StatusDetails'
prev_state:
$ref: '#/components/schemas/State'
state:
$ref: '#/components/schemas/State'
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
Variable:
title: Variable ...
required:
- schema_id
type: object
properties:
base_type:
type: string
x-go-name: BaseType
created_by:
type: string
x-go-name: CreatedBy
created_on:
type: string
format: date-time
x-go-name: CreatedOn
id:
type: string
description: ID of variable
x-go-name: VariableID
objec
# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-workflowinstances-api-openapi.yml