Workflows are TigerTrust’s automation primitive. A workflow bundles an ordered list of steps, a trigger (manual, scheduled, event, or threshold), optional conditions and approvers, and per-execution input/output. Every execution is tracked in workflow_executions with per-step results. All endpoints require authentication and a workspace context. Mutating endpoints are audit-logged.

​
List workflows

GET /api/workflows
​
page
integer
default:"1"
​
limit
integer
default:"50"
​
data[].id
integer
​
data[].name
string
​
data[].description
string
​
data[].type
string
certificate_renewal, certificate_request, certificate_revocation, or custom.
​
data[].trigger
string
manual, scheduled, event, threshold.
​
data[].triggerConfig
object
Cron string for scheduled workflows, event filter for event-driven ones.
​
data[].steps
object[]
Ordered step definitions.
​
data[].conditions
object
​
data[].notifications
object[]
​
data[].enabled
boolean
​
data[].requiresApproval
boolean
​
data[].approvers
string[]
User IDs authorized to approve.
​
data[].lastExecutedAt
string (ISO 8601)
​
data[].executionCount
integer

​
Create a workflow

POST /api/workflows
​
name
string
required
​
description
string
​
triggerType
string
default:"manual"
Maps to the DB trigger column.
​
steps
object[]
Array of step objects. Shape is step-type-specific but each carries { id, type, config }.
​
triggerConfig
object
​
conditions
object
​
notifications
object[]
​
enabled
boolean
default:"true"
​
requiresApproval
boolean
default:"false"
​
approvers
string[]
curl -X POST https://api.tigertrust.example.com/api/workflows \
  -H "X-API-Key: ck_9f2a...7c4e" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Auto-renew production TLS 30 days out",
    "description": "Renews any active TLS cert expiring in <30 days and redeploys via agent",
    "triggerType": "scheduled",
    "triggerConfig": { "cron": "0 4 * * *" },
    "steps": [
      { "id": "s1", "type": "query_certificates", "config": { "status": "expiring", "daysUntilExpiry": 30 } },
      { "id": "s2", "type": "renew_certificate", "config": { "caId": 12 } },
      { "id": "s3", "type": "deploy_certificate", "config": { "agentId": "agent-dc1-01" } }
    ],
    "notifications": [{ "channel": "slack", "on": ["failed"] }],
    "enabled": true
  }'

{
  "data": {
    "id": 214,
    "workspaceId": "ws_2p9x8f4",
    "name": "Auto-renew production TLS 30 days out",
    "type": "custom",
    "trigger": "scheduled",
    "steps": [ /* ... */ ],
    "enabled": true,
    "requiresApproval": false,
    "createdAt": "2026-08-25T14:22:03.812Z"
  }
}

​
Update a workflow

PUT /api/workflows/:id
​
id
integer
required
Accepts any subset of the create fields. Common uses: swapping the cron in triggerConfig, adding a step, updating approvers.

​
Delete a workflow

DELETE /api/workflows/:id Returns 204 No Content. Past executions are retained for audit.

​
Toggle enabled

PUT /api/workflows/:id/toggle
​
enabled
boolean
required
Suspends or resumes the workflow. Scheduled workflows stop firing immediately; in-flight executions run to completion.

​
Execute a workflow

POST /api/workflows/:id/execute Kicks off a manual run. Returns the created workflow_execution row with status=running.
​
id
integer
required
​
input
object
Input parameters passed to the first step. Shape is workflow-specific.
curl -X POST https://api.tigertrust.example.com/api/workflows/214/execute \
  -H "X-API-Key: ck_9f2a...7c4e" \
  -H "Content-Type: application/json" \
  -d '{"input": {"certificateId": 5182}}'

{
  "id": 9814,
  "workspaceId": "ws_2p9x8f4",
  "workflowId": 214,
  "status": "running",
  "trigger": "manual",
  "triggeredBy": "usr_7f2a",
  "input": { "certificateId": 5182 },
  "startedAt": "2026-08-25T14:22:03.812Z",
  "createdAt": "2026-08-25T14:22:03.812Z"
}
POST /execute is one of the endpoints that does not use the { data: ... } envelope — the execution row is returned directly.
Returns 404 NOT_FOUND if the workflow ID doesn’t exist. For workflows with requiresApproval=true, the execution is created in pending state and blocks on an approval request (see /api/approvals).

​
List executions

GET /api/workflows/executions
​
workflowId
integer
Filter to executions of a specific workflow.
​
status
string
pending, running, completed, failed, cancelled.
​
page
integer
default:"1"
​
limit
integer
default:"50"
​
data[].id
integer
​
data[].workflowId
integer
​
data[].status
string
​
data[].trigger
string
manual, scheduled, event.
​
data[].triggeredBy
string
User ID for manual runs.
​
data[].input
object
​
data[].output
object
​
data[].stepResults
object[]
Ordered per-step outcomes with { stepId, status, output, error, duration }.
​
data[].currentStep
integer
0-indexed current step for running executions.
​
data[].error
string
​
data[].startedAt
string (ISO 8601)
​
data[].completedAt
string (ISO 8601)
curl "https://api.tigertrust.example.com/api/workflows/executions?workflowId=214&status=failed" \
  -H "X-API-Key: ck_9f2a...7c4e"

​
Common step types

Step typeWhat it does
query_certificatesSelects a batch of certificates matching a filter
renew_certificateRuns the appropriate renewal method for the target CA
revoke_certificateMarks a certificate revoked and updates CRLs
deploy_certificateDispatches a cert_deploy agent task
send_notificationFires a webhook or channel notification
require_approvalBlocks until an approver acts
http_requestGeneric outbound HTTP call for custom integrations

​
See also