Cisco XDR Workflows API
The Workflows API from Cisco XDR — 20 operation(s) for workflows.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cisco-xdr-workflows-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: REST API. Workflows API
version: 1.0.0
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: visibility.amp.cisco.com
note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine.
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json
- type: source
url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: https://automate.us.security.cisco.com/{basePath}
variables:
basePath:
default: api
security:
- oAuth2:
- integration:read
- private-intel:read
- profile:read
- inspect:read
- users:read
- invite:read
- enrich:read
- oauth:read
- response:read
- global-intel:read
- ao:read
- playbook:read
tags:
- name: Workflows
paths:
/v1.1/workflows:
post:
tags:
- Workflows
summary: Handler to get all workflows.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow
Mandatory Query Param: limit -> Non Negative limit.'
operationId: getAllWorkflowsPostQueryParams
parameters:
- name: is_atomic
in: query
description: Provide true to return only atomic workflows and false for non atomic. Skip to return all workflows.
schema:
type: boolean
x-go-name: IsAtomic
x-go-name: IsAtomic
- name: search
in: query
description: Comma separated list of search terms to filter based on workflow names
schema:
type: string
x-go-name: Search
x-go-name: Search
- name: state
in: query
description: Comma separated list of workflow states to filter
schema:
type: string
x-go-name: State
x-go-name: State
- name: limit
in: query
description: Number of workflows to return for this request
required: true
schema:
type: integer
format: int64
x-go-name: Limit
x-go-name: Limit
- name: start
in: query
description: Return list of workflows from n'th workflow, n is start to be provided
schema:
type: integer
format: int64
x-go-name: Start
x-go-name: Start
- name: sort_by
in: query
description: Return list of workflows in sorted order
schema:
type: string
x-go-name: SortBy
x-go-name: SortBy
- name: from_playbook
in: query
description: Provided true to return all the workflows that have at least one observable_type added to them.
schema:
type: boolean
x-go-name: FromPlaybook
x-go-name: FromPlaybook
requestBody:
description: An request body to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowsPostRequest'
required: false
x-go-name: RequestBody
responses:
'200':
description: 'An WorkflowResponse response model
# This is used for returning a response with a single workflow as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowGetAllPaginationResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1.1/workflows/start:
post:
tags:
- Workflows
summary: Handler to start workflow execution.
description: 'Allowed Role(s): admin
Allowed User(s): Who have RUN permission to given workflow'
operationId: startWorkflowRequestV1Dot1
parameters:
- name: workflow_id
in: query
description: ID of the Workflow, to start workflow using id. (Not allow to provide both of ID and UniqueName of Workflow)
schema:
type: string
x-go-name: WorkflowID
x-go-name: WorkflowID
- name: unique_name
in: query
description: 'Unique Name of the Workflow, to start workflow using unique_name of it
(Not allow to provide both of ID and UniqueName of Workflow)'
schema:
type: string
x-go-name: UniqueName
x-go-name: UniqueName
- name: sync
in: query
description: 'if true, starts workflow with sync.
If workflow execution takes more than 28 second, API returns the current status of the instance
and workflow continue to run in the background
API returns 200 Ok on successful completion of instance
API return 201 Accepted if the workflow still in running state after 28 second'
schema:
type: boolean
x-go-name: Sync
x-go-name: Sync
- name: async
in: query
description: if true, workflow execution is processed asynchronously
schema:
type: boolean
x-go-name: Async
x-go-name: Async
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
file_name:
type: string
description: 'Upload File
Swagger UI supports only one file to upload
In case of multiple input file variables use separate rest client'
format: binary
x-go-name: File
request_body:
type: string
description: 'The workflow to submit.
Please refer /v1/workflows/start API for request_body payload'
x-go-name: RequestBody
responses:
'200':
description: 'An RunWorkflowResponse response model
# This is used for returning a response of workflow as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/StartWorkflowResponse'
'202':
description: 'An RunWorkflowResponse response model
# This is used for returning a response of workflow as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/StartWorkflowResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'412':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1.2/workflows:
post:
tags:
- Workflows
summary: Handler to get all workflows.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow
Mandatory Query Param: limit -> Non Negative limit.'
operationId: getAllWorkflowsPostQueryParamsV1Dot2
parameters:
- name: is_atomic
in: query
description: Provide true to return only atomic workflows and false for non atomic. Skip to return all workflows.
schema:
type: boolean
x-go-name: IsAtomic
x-go-name: IsAtomic
- name: search
in: query
description: Comma separated list of search terms to filter based on workflow names
schema:
type: string
x-go-name: Search
x-go-name: Search
- name: state
in: query
description: Comma separated list of workflow states to filter
schema:
type: string
x-go-name: State
x-go-name: State
- name: limit
in: query
description: Number of workflows to return for this request
required: true
schema:
type: integer
format: int64
x-go-name: Limit
x-go-name: Limit
- name: start
in: query
description: Return list of workflows from n'th workflow, n is start to be provided
schema:
type: integer
format: int64
x-go-name: Start
x-go-name: Start
- name: sort_by
in: query
description: Return list of workflows in sorted order, supported values are 'updated_on' and 'atomic_group'
schema:
type: string
x-go-name: SortBy
x-go-name: SortBy
requestBody:
description: An request body to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowsPostRequest'
required: false
x-go-name: RequestBody
responses:
'200':
description: 'An WorkflowResponse response model
# This is used for returning a response with a single workflow as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/WorkflowGetAllPaginationResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'401':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/workflows:
get:
tags:
- Workflows
summary: Handler to get all workflows.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: getAllWorkflowsQueryParamsV1
parameters:
- name: is_atomic
in: query
description: Provide true if you need only atomic workflows.
schema:
type: boolean
x-go-name: IsAtomic
x-go-name: IsAtomic
- name: categories
in: query
description: Comma separated list of category names to search for.
schema:
type: string
x-go-name: Categories
x-go-name: Categories
responses:
'200':
description: 'An WorkflowResponseV1 response model
# This is used for returning a response with a single workflow as a body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/WorkflowDefinitionGetAllResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
post:
tags:
- Workflows
summary: Handler to create a workflow definition.
description: 'Allowed Role(s): admin
Either ViewSchemaID or Type or both in request body can be provided to create a Workflow.'
operationId: workflowCreateRequest
requestBody:
description: The request to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/workflowDefinitionPostRequest'
required: true
x-go-name: RequestBody
responses:
'201':
description: 'A WorkflowDefinitonResponse model
# This is used for returning a response of Workflow as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/workflowDefinitionGetResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/workflows/batch_get:
post:
tags:
- Workflows
summary: '# Handler to retrieve a list of workflows'
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have view permission to the given list of workflows'
operationId: workflowBatchGetPostRequest
requestBody:
description: List of workflows to retrieve
content:
application/json:
schema:
type: array
items:
type: string
required: true
x-go-name: RequestBody
responses:
'200':
description: 'An WorkflowBatchGetResponse response model
# This is used for returning a response of list of workflows as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/WorkflowDefinitionGetAllResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/workflows/start:
post:
tags:
- Workflows
summary: Handler to start workflow execution.
description: 'Allowed Role(s): admin
Allowed User(s): Who have RUN permission to given workflow'
operationId: startWorkflowRequest
parameters:
- name: workflow_id
in: query
description: ID of the workflow, to start workflow using id. (Not allow to provide both of ID and UniqueName of Workflow)
schema:
type: string
x-go-name: WorkflowID
x-go-name: WorkflowID
- name: unique_name
in: query
description: 'Unique Name of the workflow, to start workflow using unique_name of it
(Not allow to provide both of ID and UniqueName of Workflow)'
schema:
type: string
x-go-name: UniqueName
x-go-name: UniqueName
- name: sync
in: query
description: 'if true, starts workflow with sync.
If workflow execution takes more than 28 second, API returns the current status of the instance
and workflow continue to run in the background
API returns 200 Ok on successful completion of instance
API return 201 Accepted if the workflow still in running state after 28 second'
schema:
type: boolean
x-go-name: Sync
x-go-name: Sync
- name: async
in: query
description: if true, workflow execution is processed asynchronously
schema:
type: boolean
x-go-name: Async
x-go-name: Async
requestBody:
description: The workflow to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/startWorklfowPostRequestPayload'
required: false
x-go-name: RequestBody
responses:
'200':
description: 'An RunWorkflowResponse response model
# This is used for returning a response of workflow as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/StartWorkflowResponse'
'202':
description: 'An RunWorkflowResponse response model
# This is used for returning a response of workflow as body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/StartWorkflowResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'412':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/workflows/start_config:
get:
tags:
- Workflows
summary: Handler to return required input parameters for the workflow.
description: 'Allowed Role(s): admin, user
Allowed User(s): Who have RUN permission to given workflow'
operationId: workflowInputParams
parameters:
- name: workflow_id
in: query
description: The ID of Workflow (Not allow to provide both of ID and UniqueName of Workflow)
schema:
type: string
x-go-name: WorkflowID
x-go-name: WorkflowID
- name: unique_name
in: query
description: The UniqueName of Workflow (Not allow to provide both of ID and UniqueName of Workflow)
schema:
type: string
x-go-name: UniqueName
x-go-name: UniqueName
responses:
'200':
description: 'An StartWorklfowCfgResponse response model
# This is used for returning a response of the workflow required parameters'
content:
application/json:
schema:
$ref: '#/components/schemas/StartWorklfowConfigResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/workflows/summary:
get:
tags:
- Workflows
summary: Handler to get a summary of workflows.
description: 'Including total number of workflows, total number of validated workflows and total number of draft workflows
Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to workflow'
operationId: worklowSummaryQueryParam
responses:
'200':
description: 'An GetWorkflowSummaryResponse model.
# It will return a summary of workflows'
content:
application/json:
schema:
$ref: '#/components/schemas/workflowSummaryResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
/v1/workflows/{workflow_id}:
get:
tags:
- Workflows
summary: Handler to return workflow information using workflow ID.
description: 'Allowed Role(s): admin, user, sat
Allowed User(s): Who have atleast VIEW permission to given workflow'
operationId: getWorkflowById
parameters:
- name: workflow_id
in: path
description: This represents the identifier of the workflow, which can be either a ksuid or a unique name.
required: true
schema:
type: string
x-go-name: WorkflowID
x-go-name: WorkflowID
responses:
'200':
description: 'A WorkflowDefinitonResponse model
# This is used for returning a response of Workflow as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/workflowDefinitionGetResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
# --- truncated at 32 KB (121 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-workflows-api-openapi.yml