SlashID Workflows API

openapi: 3.2.0
info:
  title: SlashID Workflows API
  description: "This is the [OpenAPI](https://www.openapis.org/) specification for communicating with the [SlashID](https://www.slashid.dev/) service.\n\nThe latest version of the OpenAPI API spec can be fetched from [our CDN](https://cdn.slashid.com/slashid-openapi-latest.yaml).\n\nWe recommend you use an [OpenAPI SDK generator](https://openapi.tools/#sdk) to create a client library in your programming language,\nbut you can also use this documentation to make HTTP calls directly.\n\n> **Compatibility note**: We aim to keep wire compatibility whenever we update the API, but parts of the specification may occasionally be refactored.\n  If you use an SDK generator, your code may require minor changes between versions.\n"
  version: '1.1'
  termsOfService: https://www.slashid.dev/terms-of-use/
  contact:
    name: API Support
    email: contact@slashid.dev
servers:
- url: https://api.slashid.com
  description: Production
- url: https://api.sandbox.slashid.com
  description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Workflows
paths:
  /workflows:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Create a new workflow
      description: Creates a new workflow for automated response actions
      requestBody:
        description: Workflow creation request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCreateRequest'
            examples:
              critical_detections_workflow:
                summary: Workflow for critical detections
                description: Create a workflow with just name and description. Actions and data input can be added via UPDATE endpoint.
                value:
                  name: Critical Detection Response
                  description: Automated response workflow for critical severity detections
      responses:
        '201':
          description: Workflow created successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/Workflow'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '409':
          $ref: '#/components/responses/Conflict'
    get:
      operationId: GetWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflows
      description: Retrieve a list of workflows for the organization
      parameters:
      - name: status
        in: query
        description: Filter by workflow status
        schema:
          $ref: '#/components/schemas/WorkflowStatus'
      - name: limit
        in: query
        description: Maximum number of workflows to return
        schema:
          type: integer
          default: 50
          minimum: 1
          maximum: 100
      - name: offset
        in: query
        description: Offset for pagination
        schema:
          type: integer
          default: 0
          minimum: 0
      - name: sort
        in: query
        description: 'Sort parameter in format "field:order".

          Valid fields: created_at, updated_at, name.

          Valid orders: asc, desc.

          Example: "created_at:desc" (default)

          '
        schema:
          type: string
          example: created_at:desc
      - name: type
        in: query
        description: Filter by workflow data input type
        schema:
          $ref: '#/components/schemas/WorkflowDataInputType'
      responses:
        '200':
          description: List of workflows
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        workflows:
                          type: array
                          items:
                            $ref: '#/components/schemas/Workflow'
                      required:
                      - workflows
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /workflows/{workflow_id}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get workflow details
      description: 'Retrieve details of a specific workflow.

        When include_configuration=true, the response also includes the latest workflow configuration

        (data_input_config, actions, version, etc.).

        '
      parameters:
      - name: include_configuration
        in: query
        description: Include latest workflow configuration in response
        required: false
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Workflow details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      oneOf:
                      - $ref: '#/components/schemas/Workflow'
                      - $ref: '#/components/schemas/WorkflowWithConfiguration'
                      discriminator:
                        propertyName: kind
                        mapping:
                          workflow: '#/components/schemas/Workflow'
                          workflow_with_configuration: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Update workflow
      description: Update a workflow and create a new version
      requestBody:
        description: Workflow update request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowUpdateRequest'
      responses:
        '200':
          description: Workflow updated successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Delete workflow
      description: Soft delete a workflow (marks as deleted)
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflow versions
      description: Retrieve all versions of a workflow
      responses:
        '200':
          description: List of workflow versions
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        versions:
                          type: array
                          items:
                            $ref: '#/components/schemas/WorkflowConfiguration'
                      required:
                      - versions
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions/{version}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - name: version
      in: path
      required: true
      description: Workflow version number
      schema:
        type: integer
        minimum: 1
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersionsVersion
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get specific workflow version
      description: Retrieve a specific version of a workflow
      responses:
        '200':
          description: Workflow version details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostWorkflowsWorkflowIdVersionsVersionRestore
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Restore workflow version
      description: Restore a previous version of a workflow as the latest version
      responses:
        '200':
          description: Workflow version restored successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/activate:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdActivate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Activate workflow
      description: Activate a workflow to make it operational
      responses:
        '204':
          description: Workflow activated successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/pause:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdPause
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Pause workflow
      description: Pause an active workflow
      responses:
        '204':
          description: Workflow paused successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/resume:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdResume
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Resume workflow
      description: Resume a paused workflow
      responses:
        '204':
          description: Workflow resumed successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdExecute
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Execute workflow
      description: Manually trigger workflow execution
      responses:
        '204':
          description: Workflow execution triggered successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/scheduled-execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdScheduledExecute
      tags:
      - Workflows
      summary: Internal endpoint for scheduled workflow execution
      description: 'Internal endpoint invoked by the workflow scheduler (GCP Cloud Scheduler in production, the docker-scheduler in dev) on each cron tick. Publishes a workflow execute event with trigger_source=scheduled. Not intended for external callers.

        '
      responses:
        '200':
          description: Tick accepted (or skipped if the workflow is not active)
          content:
            application/json:
              schema:
                type: object
                properties:
                  skipped:
                    type: string
                  status:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/cypher-preview:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsCypherPreview
      tags:
      - Workflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Run a read-only Cypher query and return the first 50 rows
      description: 'Synchronous preview for the Query Workflows UI. Validates the query

        (same validator as scheduled runs), runs it against the caller''s org

        graph with a 10-second timeout and a hard 50-row cap. Read-only —

        write keywords are rejected. Not intended for batch use; use the

        scheduled-execute path for production reads.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCypherPreviewRequest'
      responses:
        '200':
          description: Preview results.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewResponse'
        '400':
          description: Validation error (query empty, missing MATCH/RETURN, write keyword, etc.).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
        '504':
          description: Query exceeded the 10-second preview timeout.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
components:
  schemas:
    APICursorPagination:
      type: object
      required:
      - limit
      - cursor
      - total_count
      properties:
        limit:
          type: integer
        cursor:
          type: string
        total_count:
          type: integer
          format: int64
    APIPagination:
      type: object
      required:
      - limit
      - offset
      - total_count
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total_count:
          type: integer
          format: int64
    WorkflowUpdateRequest:
      type: object
      properties:
        name:
          type: string
          description: New workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: New workflow description
          maxLength: 1000
        data_input_config:
          $ref: '#/components/schemas/WorkflowDataInputConfiguration'
          description: 'Updated data input configuration.

            If provided, creates a new version with new data retrieval settings.

            '
        actions:
          type: object
          description: 'Updated actions configuration. Map of action ID to action configuration.

            '
          additionalProperties:
            $ref: '#/components/schemas/WorkflowActionConfiguration'
        starting_actions:
          type: array
          description: 'IDs of actions to execute first after data input completes.

            Enables tree-based execution where only these actions start initially,

            and child actions are triggered via the children field.

            '
          items:
            type: string
    WorkflowDataInputDetectionConfiguration:
      type: object
      required:
      - type
      - scim_filter
      properties:
        type:
          type: string
          enum:
          - detection
          description: Data input type discriminator
        scim_filter:
          type: string
          description: "SCIM filter string to apply when querying detections.\nExamples:\n  - `severity eq \"critical\"`\n  - `type eq \"aws_identity_unused\" and status eq \"new\"`\n  - `entity_type eq \"aws_iam_user\"`\n  - `severity eq \"critical\" or severity eq \"high\"`\n"
          minLength: 1
          example: severity eq "critical"
        limit:
          type: integer
          description: Maximum number of detections to retrieve (0 for no limit)
          default: 0
          minimum: 0
          maximum: 10000
        sorting:
          type: array
          description: Sorting configuration for results
          items:
            type: object
            required:
            - field
            - direction
            properties:
              field:
                type: string
                description: Field to sort by
                example: created_at
              direction:
                type: string
                enum:
                - asc
                - desc
                description: Sort direction
                default: desc
    WorkflowStatus:
      type: string
      enum:
      - draft
      - active
      - paused
      - deleted
      description: Current state of a workflow
    BaseActionConfiguration:
      type: object
      required:
      - id
      - type
      - enabled
      properties:
        id:
          type: string
          description: Unique identifier for this action
        type:
          $ref: '#/components/schemas/WorkflowActionType'
        name:
          type: string
          description: Human-readable name for this action
        description:
          type: string
          description: Description of what this action does
        enabled:
          type: boolean
          description: Whether this action is enabled
          default: true
        integration_id:
          type: string
          description: Optional integration ID to use for this action (e.g., specific ticketing system integration)
        children:
          type: array
          description: IDs of child actions to execute after this action completes
          items:
            type: string
          default: []
    Neo4jTemplatePredicate:
      type: object
      required:
      - kind
      - template
      properties:
        kind:
          type: string
          enum:
          - neo4j_template
        template:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
    APIResponseBase:
      type: object
      properties:
        meta:
          $ref: '#/components/schemas/APIMeta'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/APIResponseError'
    WorkflowDataInputUarFindingConfiguration:
      type: object
      required:
      - type
      description: 'Filters which UarFindingV1 events this workflow should run on.

        In v1 the only emitted trigger is `manual`; other trigger values

        (decision_revoked, decision_effective, level_completed,

        campaign_completed) are accepted for forward-compat with the

        auto-trigger work but never match an event until those triggers

        ship. Backed by

        backend/modules/workflows/entities/workflow_data_input_uar_finding_configuration.go.

        '
      properties:
        type:
          type: string
          enum:
          - uar_finding
          description: Data input type discriminator
        triggers:
          type: array
          items:
            type: string
          description: 'UarFindingV1 trigger reasons that fire this workflow (ANY

            match). Defaults to `["manual"]` when empty.

            '
        campaign_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by specific campaign IDs. Empty matches all.
        campaign_template_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by campaign template IDs. Empty matches all.
        campaign_types:
          type: array
          items:
            type: string
          description: 'Filter by campaign type (e.g. `user`, `resource`,

            `non_human_identity`). Empty matches all.

            '
        classification_tags:
          type: array
          items:
            type: string
          description: Filter by classification tags on the finding. Empty matches all.
        outcomes:
          type: array
          items:
            type: string
          description: Filter by reviewer decision outcome (e.g. `approve`, `revoke`). Empty matches all.
        only_effective:
          type: boolean
          default: false
          description: 'Match only when `effective_outcome == outcome` — the decision

            survived multi-tier escalation rather than being overridden.

            '
        min_level:
          type: integer
          minimum: 0
          description: Filter by decision level >= this value.
        only_high_privilege:
          type: boolean
          default: false
          description: Restrict to findings flagged as high-privilege.
        user_source_types:
          type: array
          items:
            type: string
          description: Filter by user identity source type. Empty matches all.
        user_entity_types:
          type: array
          items:
            type: string
          description: Filter by user entity type. Empty matches all.
        asset_source_types:
          type: array
          items:
            type: string
          description: Filter by asset source type. Empty matches all.
        asset_entity_types:
          type: array
          items:
            type: string
          description: Filter by asset entity type. Empty matches all.
        granting_entity_types:
          type: array
          items:
            type: string
          description: Filter by granting entity type (e.g. role, group). Empty matches all.
        scim_filter:
          type: string
          description: 'Optional SCIM-style filter over the flattened finding payload,

            applied after the structured filters above.

            '
    WorkflowCypherPreviewError:
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
          description: Stable error code (see backend cypher validator sentinels).
          example: cypher_write_keyword
        message:
          type: string
          description: Human-readable detail. May reference server-side context.
    PgTemplatePredicate:
      type: object
      required:
      - kind
      - template
      properties:
        kind:
          type: string
          enum:
          - pg_template
        template:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
    WorkflowDataInputLifecycleConfiguration:
      type: object
      required:
      - type
      - event_types
      properties:
        type:
          type: string
          enum:
          - lifecycle
          description: Data input type discriminator
        event_types:
          type: array
          items:
            $ref: '#/components/schemas/LifecycleEventType'
          minItems: 1
          description: Lifecycle events that trigger this workflow
          example:
          - created
          - deleted
        entity_types:
          type: array
          items:
            type: string
          description: Filter by entity types (e.g., aws_iam_user, entra_user). If empty, all entity types are matched.
          example:
          - aws_iam_user
          - entra_user
        source_types:
          type: array
          items:
            type: string
          description: Filter by identity source types (e.g., aws_account, entra). If empty, all source types are matched.
          example:
          - aws_account
          - entra
        connection_ids:
          type: array
          items:
            type: string
          description: Filter by specific connection IDs. If empty, all connections are matched.
        min_risk_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Only trigger for entities with risk score >= this value
        max_risk_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Only trigger for entities with risk score <= this value
        include_relationships:
          type: boolean
          default: false
          description: Fetch manager, groups, direct reports from Neo4j
        include_permissions:
          type: boolean
          default: false
          description: Fetch permission assignments from Neo4j
        include_access_history:
          type: boolean
          default: false
          description: Fetch recent access records from Neo4j
        relationship_depth:
          type: integer
          minimum: 0
          maximum: 3
          default: 1
          description: How deep to traverse relationships in Neo4j (default 1, max 3)
        scim_filter:
          type: string
          description: Additional SCIM-style filter criteria for the entity
    OrPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - or
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    RemediationActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - action
        - target_type
        properties:
          action:
            $ref: '#/components/schemas/RemediationActionType'
          target_type:
            $ref: '#/components/schemas/RemediationTargetType'
          parameters:
            type: object
            additionalProperties: true
            description: Action-specific parameters
            example:
              group_name: suspended_users
              reason: Suspicious activity detected
          dry_run:
            type: boolean
            description: If true, action is simulated but not executed (logs what would happen)
            default: false
    RemediationTargetType:
      type: string
      enum:
      - user
      - session
      - credential
      - api_key
      - group_membership
      - role
      - permission
      - entity
      - group
      description: Target of the remediation action
    EventCountSource:
      oneOf:
      - $ref: '#/components/schemas/PgDetectionSource'
      - $ref: '#/components/schemas/BigQueryAnalyticsSource'
      discriminator:
        propertyName: kind
        mapping:
          pg_detection: '#/components/schemas/PgDetectionSource'
          bigquery_analytics: '#/components/schemas/BigQueryAnalyticsSource'
    APIResponseError:
      type: object
      properties:
        httpcode:
          type: integer
        message:
          type: string
    WorkflowCreateRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: Workflow description
          maxLength: 1000
    AndPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - and
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    PgDetectionSource:
      type: object
      required:
      - kind
      - match
      properties:
        kind:
          type: string
          enum:
          - pg_detection
        match:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
    EventCountOverWindowPredicate:
      type: object
      required:
      - kind
      - source
      - window
      - operator
      - threshold
      properties:
        kind:
          type: string
          enum:
          - event_count_over_window
        source:
          $ref: '#/components/schemas/EventCountSource'
        window:
          type: string
          example: 1h
          description: Duration string (e.g. "1h", "24h", "7d").
        operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        threshold:
          type: integer
          format: int64
          minimum: 0
    LifecycleEventType:
      type: string
      enum:
      - created
      - deleted
      - suspended
      - modified
      - reactivated
      - role_changed
      - group_added
      - group_removed
      - risk_score_changed
      - inactive_threshold
      description: 'Type of user lifecycle event that triggers the workflow.

        Phase 1 (Core): created, deleted, suspended

        Phase 2 (Extended): modified, reactivated, role_changed, group_added, group_removed, risk_score_changed, inactive_threshold

        '
    NotPredicate:
      type: object
      required:
      - kind
      - predicate
      properties:
        kind

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/slashid/refs/heads/main/openapi/slashid-workflows-api-openapi.yml