SlashID Workflows API

openapi: 3.0.1
info:
  title: SlashID Groups Workflows API
  description: "This is the [OpenAPI](https://www.openapis.org/) specification for communicating with the [SlashID](https://www.slashid.dev/) service.\n\nThe latest version of the OpenAPI API spec can be fetched from [our CDN](https://cdn.slashid.com/slashid-openapi-latest.yaml).\n\nWe recommend you use an [OpenAPI SDK generator](https://openapi.tools/#sdk) to create a client library in your programming language,\nbut you can also use this documentation to make HTTP calls directly.\n\n> **Compatibility note**: We aim to keep wire compatibility whenever we update the API, but parts of the specification may occasionally be refactored.\n  If you use an SDK generator, your code may require minor changes between versions.\n"
  version: '1.1'
  termsOfService: https://www.slashid.dev/terms-of-use/
  contact:
    name: API Support
    email: contact@slashid.dev
servers:
- url: https://api.slashid.com
  description: Production
- url: https://api.sandbox.slashid.com
  description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Workflows
paths:
  /workflows:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Create a new workflow
      description: Creates a new workflow for automated response actions
      requestBody:
        description: Workflow creation request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCreateRequest'
            examples:
              critical_detections_workflow:
                summary: Workflow for critical detections
                description: Create a workflow with just name and description. Actions and data input can be added via UPDATE endpoint.
                value:
                  name: Critical Detection Response
                  description: Automated response workflow for critical severity detections
      responses:
        '201':
          description: Workflow created successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/Workflow'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '409':
          $ref: '#/components/responses/Conflict'
    get:
      operationId: GetWorkflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflows
      description: Retrieve a list of workflows for the organization
      parameters:
      - name: status
        in: query
        description: Filter by workflow status
        schema:
          $ref: '#/components/schemas/WorkflowStatus'
      - name: limit
        in: query
        description: Maximum number of workflows to return
        schema:
          type: integer
          default: 50
          minimum: 1
          maximum: 100
      - name: offset
        in: query
        description: Offset for pagination
        schema:
          type: integer
          default: 0
          minimum: 0
      - name: sort
        in: query
        description: 'Sort parameter in format "field:order".

          Valid fields: created_at, updated_at, name.

          Valid orders: asc, desc.

          Example: "created_at:desc" (default)

          '
        schema:
          type: string
          example: created_at:desc
      - name: type
        in: query
        description: Filter by workflow data input type
        schema:
          $ref: '#/components/schemas/WorkflowDataInputType'
      responses:
        '200':
          description: List of workflows
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        workflows:
                          type: array
                          items:
                            $ref: '#/components/schemas/Workflow'
                      required:
                      - workflows
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /workflows/{workflow_id}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get workflow details
      description: 'Retrieve details of a specific workflow.

        When include_configuration=true, the response also includes the latest workflow configuration

        (data_input_config, actions, version, etc.).

        '
      parameters:
      - name: include_configuration
        in: query
        description: Include latest workflow configuration in response
        required: false
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Workflow details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      oneOf:
                      - $ref: '#/components/schemas/Workflow'
                      - $ref: '#/components/schemas/WorkflowWithConfiguration'
                      discriminator:
                        propertyName: kind
                        mapping:
                          workflow: '#/components/schemas/Workflow'
                          workflow_with_configuration: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Update workflow
      description: Update a workflow and create a new version
      requestBody:
        description: Workflow update request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowUpdateRequest'
      responses:
        '200':
          description: Workflow updated successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowWithConfiguration'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteWorkflowsWorkflowId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Delete workflow
      description: Soft delete a workflow (marks as deleted)
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: List workflow versions
      description: Retrieve all versions of a workflow
      responses:
        '200':
          description: List of workflow versions
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: object
                      properties:
                        versions:
                          type: array
                          items:
                            $ref: '#/components/schemas/WorkflowConfiguration'
                      required:
                      - versions
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/versions/{version}:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - name: version
      in: path
      required: true
      description: Workflow version number
      schema:
        type: integer
        minimum: 1
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetWorkflowsWorkflowIdVersionsVersion
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Workflows
      summary: Get specific workflow version
      description: Retrieve a specific version of a workflow
      responses:
        '200':
          description: Workflow version details
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostWorkflowsWorkflowIdVersionsVersionRestore
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Restore workflow version
      description: Restore a previous version of a workflow as the latest version
      responses:
        '200':
          description: Workflow version restored successfully
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WorkflowConfiguration'
                  required:
                  - result
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/activate:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdActivate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Activate workflow
      description: Activate a workflow to make it operational
      responses:
        '204':
          description: Workflow activated successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/pause:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdPause
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Pause workflow
      description: Pause an active workflow
      responses:
        '204':
          description: Workflow paused successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/resume:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdResume
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Resume workflow
      description: Resume a paused workflow
      responses:
        '204':
          description: Workflow resumed successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdExecute
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Workflows
      summary: Execute workflow
      description: Manually trigger workflow execution
      responses:
        '204':
          description: Workflow execution triggered successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/{workflow_id}/scheduled-execute:
    parameters:
    - name: workflow_id
      in: path
      required: true
      description: Workflow identifier
      schema:
        type: string
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsWorkflowIdScheduledExecute
      tags:
      - Workflows
      summary: Internal endpoint for scheduled workflow execution
      description: 'Internal endpoint invoked by the workflow scheduler (GCP Cloud Scheduler in production, the docker-scheduler in dev) on each cron tick. Publishes a workflow execute event with trigger_source=scheduled. Not intended for external callers.

        '
      responses:
        '200':
          description: Tick accepted (or skipped if the workflow is not active)
          content:
            application/json:
              schema:
                type: object
                properties:
                  skipped:
                    type: string
                  status:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /workflows/cypher-preview:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostWorkflowsCypherPreview
      tags:
      - Workflows
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Run a read-only Cypher query and return the first 50 rows
      description: 'Synchronous preview for the Query Workflows UI. Validates the query

        (same validator as scheduled runs), runs it against the caller''s org

        graph with a 10-second timeout and a hard 50-row cap. Read-only —

        write keywords are rejected. Not intended for batch use; use the

        scheduled-execute path for production reads.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowCypherPreviewRequest'
      responses:
        '200':
          description: Preview results.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewResponse'
        '400':
          description: Validation error (query empty, missing MATCH/RETURN, write keyword, etc.).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
        '504':
          description: Query exceeded the 10-second preview timeout.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowCypherPreviewError'
components:
  schemas:
    Neo4jTemplatePredicate:
      type: object
      required:
      - kind
      - template
      properties:
        kind:
          type: string
          enum:
          - neo4j_template
        template:
          type: string
        params:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ParamValue'
        expect:
          type: boolean
        count_operator:
          type: string
          enum:
          - gt
          - gte
          - lt
          - lte
          - eq
          - neq
        count_threshold:
          type: integer
          format: int64
    WorkflowUpdateRequest:
      type: object
      properties:
        name:
          type: string
          description: New workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: New workflow description
          maxLength: 1000
        data_input_config:
          $ref: '#/components/schemas/WorkflowDataInputConfiguration'
          description: 'Updated data input configuration.

            If provided, creates a new version with new data retrieval settings.

            '
        actions:
          type: object
          description: 'Updated actions configuration. Map of action ID to action configuration.

            '
          additionalProperties:
            $ref: '#/components/schemas/WorkflowActionConfiguration'
        starting_actions:
          type: array
          description: 'IDs of actions to execute first after data input completes.

            Enables tree-based execution where only these actions start initially,

            and child actions are triggered via the children field.

            '
          items:
            type: string
    Predicate:
      oneOf:
      - $ref: '#/components/schemas/AndPredicate'
      - $ref: '#/components/schemas/OrPredicate'
      - $ref: '#/components/schemas/NotPredicate'
      - $ref: '#/components/schemas/ScimPredicate'
      - $ref: '#/components/schemas/PgQueryPredicate'
      - $ref: '#/components/schemas/PgTemplatePredicate'
      - $ref: '#/components/schemas/Neo4jQueryPredicate'
      - $ref: '#/components/schemas/Neo4jTemplatePredicate'
      - $ref: '#/components/schemas/EventCountOverWindowPredicate'
      discriminator:
        propertyName: kind
        mapping:
          and: '#/components/schemas/AndPredicate'
          or: '#/components/schemas/OrPredicate'
          not: '#/components/schemas/NotPredicate'
          scim: '#/components/schemas/ScimPredicate'
          pg_query: '#/components/schemas/PgQueryPredicate'
          pg_template: '#/components/schemas/PgTemplatePredicate'
          neo4j_query: '#/components/schemas/Neo4jQueryPredicate'
          neo4j_template: '#/components/schemas/Neo4jTemplatePredicate'
          event_count_over_window: '#/components/schemas/EventCountOverWindowPredicate'
    AndPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - and
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    NotificationActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - notification_type
        - recipients
        properties:
          notification_type:
            type: string
            enum:
            - email
            - slack
            - teams
            - pagerduty
            - sms
            description: Type of notification to send
          recipients:
            type: array
            items:
              type: string
            description: Notification recipients
            example:
            - security-team@example.com
            - '#security-alerts'
          subject_template:
            type: string
            description: Template for notification subject
          message_template:
            type: string
            description: Template for notification message
          severity:
            type: string
            enum:
            - info
            - warning
            - error
            - critical
            description: Notification severity level
            default: warning
          include_data:
            type: boolean
            description: Whether to include detection data in notification
            default: true
    WebhookActionConfiguration:
      allOf:
      - $ref: '#/components/schemas/BaseActionConfiguration'
      - type: object
        required:
        - url
        - method
        properties:
          url:
            type: string
            format: uri
            description: Webhook endpoint URL
          method:
            type: string
            enum:
            - POST
            - PUT
            - PATCH
            description: HTTP method to use
            default: POST
          headers:
            type: object
            additionalProperties:
              type: string
            description: Custom headers to send
          body_template:
            type: string
            description: Template for request body
          timeout_seconds:
            type: integer
            description: Request timeout in seconds
            default: 30
            minimum: 1
            maximum: 300
          retry_config:
            type: object
            properties:
              max_retries:
                type: integer
                default: 3
                minimum: 0
                maximum: 10
              backoff_seconds:
                type: integer
                default: 5
                minimum: 1
    RemediationTargetType:
      type: string
      enum:
      - user
      - session
      - credential
      - api_key
      - group_membership
      - role
      - permission
      - entity
      - group
      description: Target of the remediation action
    WorkflowDataInputUarFindingConfiguration:
      type: object
      required:
      - type
      description: 'Filters which UarFindingV1 events this workflow should run on.

        In v1 the only emitted trigger is `manual`; other trigger values

        (decision_revoked, decision_effective, level_completed,

        campaign_completed) are accepted for forward-compat with the

        auto-trigger work but never match an event until those triggers

        ship. Backed by

        backend/modules/workflows/entities/workflow_data_input_uar_finding_configuration.go.

        '
      properties:
        type:
          type: string
          enum:
          - uar_finding
          description: Data input type discriminator
        triggers:
          type: array
          items:
            type: string
          description: 'UarFindingV1 trigger reasons that fire this workflow (ANY

            match). Defaults to `["manual"]` when empty.

            '
        campaign_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by specific campaign IDs. Empty matches all.
        campaign_template_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Filter by campaign template IDs. Empty matches all.
        campaign_types:
          type: array
          items:
            type: string
          description: 'Filter by campaign type (e.g. `user`, `resource`,

            `non_human_identity`). Empty matches all.

            '
        classification_tags:
          type: array
          items:
            type: string
          description: Filter by classification tags on the finding. Empty matches all.
        outcomes:
          type: array
          items:
            type: string
          description: Filter by reviewer decision outcome (e.g. `approve`, `revoke`). Empty matches all.
        only_effective:
          type: boolean
          default: false
          description: 'Match only when `effective_outcome == outcome` — the decision

            survived multi-tier escalation rather than being overridden.

            '
        min_level:
          type: integer
          minimum: 0
          description: Filter by decision level >= this value.
        only_high_privilege:
          type: boolean
          default: false
          description: Restrict to findings flagged as high-privilege.
        user_source_types:
          type: array
          items:
            type: string
          description: Filter by user identity source type. Empty matches all.
        user_entity_types:
          type: array
          items:
            type: string
          description: Filter by user entity type. Empty matches all.
        asset_source_types:
          type: array
          items:
            type: string
          description: Filter by asset source type. Empty matches all.
        asset_entity_types:
          type: array
          items:
            type: string
          description: Filter by asset entity type. Empty matches all.
        granting_entity_types:
          type: array
          items:
            type: string
          description: Filter by granting entity type (e.g. role, group). Empty matches all.
        scim_filter:
          type: string
          description: 'Optional SCIM-style filter over the flattened finding payload,

            applied after the structured filters above.

            '
    WorkflowActionType:
      type: string
      enum:
      - remediation
      - ticket
      - data_sink
      - webhook
      - notification
      - condition
      description: Type of workflow action
    Workflow:
      type: object
      required:
      - kind
      - id
      - org_id
      - name
      - status
      - created_by
      - created_at
      - updated_by
      - updated_at
      - execution_count
      - success_count
      - failure_count
      - latest_configuration_version
      properties:
        kind:
          type: string
          enum:
          - workflow
          - workflow_with_configuration
          description: 'Discriminator for the GET /workflows/{id} response variant.

            `workflow` is returned when `include_configuration=false`;

            `workflow_with_configuration` when the latest version is bundled

            into the response. The enum lists both values intentionally so

            the schema composition `WorkflowWithConfiguration = allOf

            [Workflow, WorkflowConfiguration]` doesn''t produce an

            unsatisfiable enum constraint; the discriminator on the

            endpoint''s `oneOf` does the runtime dispatch. Required so the

            typescript-fetch generator emits switch-based dispatch (needed

            since openapi-generator-cli v7 — see PR #5928) instead of

            order-sensitive `instanceOf` checks that silently drop the

            configuration fields when both schemas overlap.

            '
        id:
          type: string
          description: Unique workflow identifier
        org_id:
          type: string
          description: Organization ID
        name:
          type: string
          description: Workflow name
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: Workflow description
          maxLength: 1000
        status:
          $ref: '#/components/schemas/WorkflowStatus'
        created_by:
          type: string
          description: User ID who created the workflow
        created_at:
          type: string
          format: date-time
          description: Workflow creation timestamp
        updated_by:
          type: string
          description: User ID who last updated the workflow
        updated_at:
          type: string
          format: date-time
          description: Last update timestamp
        activated_at:
          type: string
          format: date-time
          description: When workflow was first activated
        paused_at:
          type: string
          format: date-time
          description: When workflow was paused
        last_executed_at:
          type: string
          format: date-time
          description: Last execution timestamp
        execution_count:
          type: integer
          description: Total execution count
          minimum: 0
        success_count:
          type: integer
          description: Successful execution count
          minimum: 0
        failure_count:
          type: integer
          description: Failed execution count
          minimum: 0
        latest_configuration_id:
          type: string
          description: ID of the latest configuration version
        latest_configuration_version:
          type: integer
          description: Latest configuration version number
          minimum: 0
    WorkflowActionConfiguration:
      oneOf:
      - $ref: '#/components/schemas/RemediationActionConfiguration'
      - $ref: '#/components/schemas/TicketActionConfiguration'
      - $ref: '#/components/schemas/DataSinkActionConfiguration'
      - $ref: '#/components/schemas/WebhookActionConfiguration'
      - $ref: '#/components/schemas/NotificationActionConfiguration'
      - $ref: '#/components/schemas/ConditionActionConfiguration'
      discriminator:
        propertyName: type
        mapping:
          remediation: '#/components/schemas/RemediationActionConfiguration'
          ticket: '#/components/schemas/TicketActionConfiguration'
          data_sink: '#/components/schemas/DataSinkActionConfiguration'
          webhook: '#/components/schemas/WebhookActionConfiguration'
          notification: '#/components/schemas/NotificationActionConfiguration'
          condition: '#/components/schemas/ConditionActionConfiguration'
    ParamValue:
      type: object
      description: Exactly one of literal or path must be set.
      properties:
        literal: {}
        path:
          type: string
          description: JSONPath expression resolved against the WorkflowDataItem at evaluation time.
    OrPredicate:
      type: object
      required:
      - kind
      - predicates
      properties:
        kind:
          type: string
          enum:
          - or
        predicates:
          type: array
          items:
            $ref: '#/components/schemas/Predicate'
          minItems: 1
    APIResponseBase:
      type: object
      properties:
        meta:
          $ref: '#/components/schemas/APIMeta'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/APIResponseError'
    EventCountSource:
      oneOf:
      - $ref: '#/components/schemas/PgDetectionSource'
      - $ref: '#/components/schemas/BigQueryAnalyticsSource'
      discriminator:
        propertyName: kind
        mapping:
          pg_detection: '#/components/schemas/PgDetectionSource'
          bigquery_analytics: '#/components/schemas/BigQueryAnalyticsSource'
    WorkflowDataInputConfiguration:
      oneOf:
      - $ref: '#/components/schemas/WorkflowDataInputDetectionConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputLifecycleConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputUarFindingConfiguration'
      - $ref: '#/components/schemas/WorkflowDataInputCypherConfiguration'
      discriminator:
        propertyName: type
        mapping:
          detection: '#/components/schemas/WorkflowDataInputDetectionConfiguration'
          lifecycle: '#/components/schemas/WorkflowDataInputLifecycleConfiguration'
          uar_finding: '#/components/schemas/WorkflowDataInputUarFindingConfiguration'
          cypher_query: '#/components/schemas/WorkflowDataInputCypherConfiguration'
    APIPagination:
      type: object
      required:
      - limit
      - offset
      - total_count
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total_count:
          type: i

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/slashid/refs/heads/main/openapi/slashid-workflows-api-openapi.yml