Upwind workflows API
The workflows API from Upwind — 2 operation(s) for workflows.
OpenAPI Specification
openapi: 3.0.3
info:
title: Upwind Management REST API v1 access-management workflows API
version: '1.0'
description: Upwind Management REST API — administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.
contact:
name: Upwind Support
email: support@upwind.io
url: https://docs.upwind.io/
x-apievangelist:
generated: '2026-07-21'
method: searched
source: https://docs.upwind.io/restapi/v1/introduction (embedded docusaurus-plugin-openapi-docs operation JSON)
servers:
- url: https://api.upwind.io
description: Production endpoint (US)
- url: https://api.eu.upwind.io
description: Production endpoint (EU)
- url: https://api.me.upwind.io
description: Production endpoint (ME)
security:
- OAuth2ClientCredentials: []
tags:
- name: workflows
paths:
/v1/organizations/{organization-id}/workflows:
post:
operationId: createWorkflow
summary: Create a workflow
description: A `POST` request sent to the endpoint root creates a Workflow object that is associated with the specified organization. Workflows provide automation capabilities for responding to security events, vulnerabilities, and configuration findings. To learn more about Workflows, refer to the [Workflows](/settings/workflows) page.
tags:
- workflows
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
config:
description: Workflow configuration (triggered or scheduled)
oneOf:
- allOf:
- type: object
description: The configuration settings for a workflow, supporting both triggered and scheduled workflows.
properties:
actions:
type: array
description: List of actions that are executed when this workflow is triggered.
items:
oneOf:
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
recipients:
type: array
description: List of email recipients. Required when `target_audience` is `CUSTOM`.
items:
type: string
target_audience:
type: string
description: The target audience for the email. Use `ALL` to send to all organization members, or `CUSTOM` to specify recipients manually.
enum:
- ALL
- CUSTOM
title: Email
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
assignee_id:
type: string
description: The Jira assignee ID.
custom_fields:
type: object
additionalProperties: {}
issue_type_id:
type: string
description: The Jira issue type ID.
labels:
type: array
description: List of labels for the Jira issue.
items:
type: string
project_id:
type: string
description: The Jira project ID.
reporter_id:
type: string
description: The Jira reporter ID.
title: Jira
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
channel:
type: string
description: The Slack channel for the action.
message:
type: string
description: The message content for the action.
title: Slack
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
webhook_id:
type: string
description: The ID of the integration webhook to use.
title: Webhook
selectors:
type: array
description: List of selectors that filter resources for this workflow.
items:
oneOf:
- allOf:
- type: object
description: Base workflow selector. The concrete implementation is selected by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of selector.
enum:
- LABEL
- TAG
- ENDPOINT_TAG
- CLOUD_PROVIDER
- CLOUD_ACCOUNT
- VPC
- RESOURCE_NAME
- RESOURCE_KIND
- HOST
- CLUSTER
- CLUSTER_NAME
- NAMESPACE
title: BaseWorkflowSelector
- type: object
properties:
key_values:
type: array
description: List of key-value pairs for this selector.
items:
type: object
properties:
key:
type: string
description: The key of the key-value pair.
value:
type: string
description: The value of the key-value pair.
title: KeyValuePair
title: Key-Value Selector
- allOf:
- type: object
description: Base workflow selector. The concrete implementation is selected by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of selector.
enum:
- LABEL
- TAG
- ENDPOINT_TAG
- CLOUD_PROVIDER
- CLOUD_ACCOUNT
- VPC
- RESOURCE_NAME
- RESOURCE_KIND
- HOST
- CLUSTER
- CLUSTER_NAME
- NAMESPACE
title: BaseWorkflowSelector
- type: object
properties:
values:
type: array
description: List of values for this selector.
items:
type: string
title: Values Selector
title: WorkflowConfig
- type: object
properties:
config:
type: object
description: Base config for scheduled workflows. The concrete type is determined by the 'type' field.
discriminator:
propertyName: type
oneOf:
- allOf:
- circular(BaseScheduledJobConfig)
title: DailySummaryReportJobConfig
- allOf:
- circular(BaseScheduledJobConfig)
title: WeeklySummaryReportJobConfig
- allOf:
- circular(BaseScheduledJobConfig)
- type: object
properties:
framework_ids:
type: array
items:
type: string
minItems: 1
report_frequency:
type: string
enum:
- DAILY
- WEEKLY
- MONTHLY
minLength: 1
required:
- framework_ids
- report_frequency
title: ConfigurationFrameworkReportJobConfig
properties:
type:
type: string
enum:
- DAILY_REPORT
- WEEKLY_REPORT
- CONFIGURATION_FRAMEWORK_REPORT
title: BaseScheduledJobConfig
cron:
type: string
title: ScheduledWorkflowConfig
- allOf:
- type: object
description: The configuration settings for a workflow, supporting both triggered and scheduled workflows.
properties:
actions:
type: array
description: List of actions that are executed when this workflow is triggered.
items:
oneOf:
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
recipients:
type: array
description: List of email recipients. Required when `target_audience` is `CUSTOM`.
items:
type: string
target_audience:
type: string
description: The target audience for the email. Use `ALL` to send to all organization members, or `CUSTOM` to specify recipients manually.
enum:
- ALL
- CUSTOM
title: Email
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
assignee_id:
type: string
description: The Jira assignee ID.
custom_fields:
type: object
additionalProperties: {}
issue_type_id:
type: string
description: The Jira issue type ID.
labels:
type: array
description: List of labels for the Jira issue.
items:
type: string
project_id:
type: string
description: The Jira project ID.
reporter_id:
type: string
description: The Jira reporter ID.
title: Jira
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
channel:
type: string
description: The Slack channel for the action.
message:
type: string
description: The message content for the action.
title: Slack
- allOf:
- type: object
description: Base workflow action. The actual action type is determined by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The action type.
enum:
- SLACK
- JIRA
- EMAIL
- WEBHOOK
title: BaseWorkflowAction
- type: object
properties:
webhook_id:
type: string
description: The ID of the integration webhook to use.
title: Webhook
selectors:
type: array
description: List of selectors that filter resources for this workflow.
items:
oneOf:
- allOf:
- type: object
description: Base workflow selector. The concrete implementation is selected by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of selector.
enum:
- LABEL
- TAG
- ENDPOINT_TAG
- CLOUD_PROVIDER
- CLOUD_ACCOUNT
- VPC
- RESOURCE_NAME
- RESOURCE_KIND
- HOST
- CLUSTER
- CLUSTER_NAME
- NAMESPACE
title: BaseWorkflowSelector
- type: object
properties:
key_values:
type: array
description: List of key-value pairs for this selector.
items:
type: object
properties:
key:
type: string
description: The key of the key-value pair.
value:
type: string
description: The value of the key-value pair.
title: KeyValuePair
title: Key-Value Selector
- allOf:
- type: object
description: Base workflow selector. The concrete implementation is selected by the 'type' property.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of selector.
enum:
- LABEL
- TAG
- ENDPOINT_TAG
- CLOUD_PROVIDER
- CLOUD_ACCOUNT
- VPC
- RESOURCE_NAME
- RESOURCE_KIND
- HOST
- CLUSTER
- CLUSTER_NAME
- NAMESPACE
title: BaseWorkflowSelector
- type: object
properties:
values:
type: array
description: List of values for this selector.
items:
type: string
title: Values Selector
title: WorkflowConfig
- type: object
properties:
trigger:
description: The trigger configuration for this workflow. Required when workflow type is `TRIGGERED`.
oneOf:
- allOf:
- type: object
description: Base trigger config. Subtype selected by the 'type' field.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of trigger.
enum:
- EVENT
- THREAT_DETECTION
- RUNTIME_EXPOSURE_CVE
- HIGH_IMPACT_VULNERABILITY
- THREAT_STORY
- CONFIGURATION_FINDING
title: BaseWorkflowTrigger
- type: object
properties:
framework_ids:
type: array
items:
type: string
severities:
type: array
description: List of severity levels that trigger the workflow.
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
items:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
title: ConfigurationFindingWorkflowTrigger
- allOf:
- type: object
description: Base trigger config. Subtype selected by the 'type' field.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of trigger.
enum:
- EVENT
- THREAT_DETECTION
- RUNTIME_EXPOSURE_CVE
- HIGH_IMPACT_VULNERABILITY
- THREAT_STORY
- CONFIGURATION_FINDING
title: BaseWorkflowTrigger
- type: object
properties:
categories:
type: array
description: List of categories that trigger the workflow.
items:
type: string
enum:
- NETWORK
- PROCESS
- FILE_SYSTEM
- EXCESSIVE_PRIVILEGE
- CLOUD_LOGS
- CLOUD_ACTIVITY_LOGS
- FILE_EVENTS
- FILES
- CLOUD_TRAIL
- SYSCALL_EVENT
- API_SECURITY
- NETWORK_BASELINE
title: EventWorkflowTrigger
- allOf:
- type: object
description: Base trigger config. Subtype selected by the 'type' field.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of trigger.
enum:
- EVENT
- THREAT_DETECTION
- RUNTIME_EXPOSURE_CVE
- HIGH_IMPACT_VULNERABILITY
- THREAT_STORY
- CONFIGURATION_FINDING
title: BaseWorkflowTrigger
- type: object
properties:
cron:
type: string
epss_severities:
type: array
description: List of EPSS severity levels that trigger the workflow.
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
items:
type: string
enum:
- NONE
- UNCLASSIFIED
- LOW
- MEDIUM
- HIGH
- CRITICAL
severities:
type: array
description: List of severity levels that trigger the workflow.
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
items:
type: string
enum:
- OTHER
- UNCLASSIFIED
- LOW
- MEDIUM
- HIGH
- CRITICAL
title: RuntimeExposureCveWorkflowTrigger
- allOf:
- type: object
description: Base trigger config. Subtype selected by the 'type' field.
discriminator:
propertyName: type
properties:
type:
type: string
description: The type of trigger.
enum:
- EVENT
- THREAT_DETECTION
- RUNTIME_EXPOSURE_CVE
# --- truncated at 32 KB (287 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upwind/refs/heads/main/openapi/upwind-workflows-api-openapi.yml