What it is
A workflow is a sequence of steps that runs automatically when its trigger fires, optionally gated by conditions and human approvals. Every execution is persisted with per-step output and timing, so you can debug failures and replay a failed run after fixing the underlying issue.When to use it
- Auto-renew wildcard certificates that match a specific naming pattern on a nightly schedule.
- Pause issuance of production certificates until a security lead approves.
- Send a Slack notification every time a certificate is deployed to a load balancer.
- Trigger a discovery scan from an external CI system via a webhook.
- Run a compliance report and email it to stakeholders every quarter.
Trigger types
| Trigger | Typical use |
|---|---|
manual | Ad-hoc bulk operations from the dashboard or API |
schedule | Nightly reconciliation, weekly reports (cron expression) |
event | Auto-remediation when certificate.expiring, discovery.new, or alert.fired |
api | External systems trigger via the workflow’s webhook URL |
Step action types
| Action | Purpose |
|---|---|
renew_certificate | Trigger renewal for a certificate |
deploy_certificate | Push a certificate to agents, load balancers, or clusters |
revoke_certificate | Revoke and publish to CRL |
create_approval | Insert an approval request and pause the workflow |
notify | Send to one or more notification channels |
webhook | POST to an external URL with a signed payload |
wait | Sleep for a duration or until a condition |
run_workflow | Nested workflow invocation |
Set it up
Choose a trigger
Select the trigger type. For schedules, enter a cron expression. For events, choose the event type from the dropdown. For API triggers, copy the generated webhook URL.
Add conditions (optional)
Click Add condition to gate the workflow. For example: only run when
certificate.commonName starts with *. and daysUntilExpiry is less than 30.Add steps
Click Add step and choose an action. Steps run in order; each step can reference the trigger payload and prior step outputs using template variables.
Add an approval step (optional)
Toggle Requires approval on any step that should pause for human review. Select the approvers from your workspace members. The workflow resumes automatically once the required approvers act.
What you’ll see
Automation > Workflows shows the list of workflows with their trigger type, last run status, and enabled/disabled state. Click a workflow to see its execution history. Click any execution row to drill into per-step output, timing, and error messages.Every workflow create, update, enable/disable, and execute action is written to the audit log. Failed executions preserve step-level error messages so you can replay after fixing the underlying issue.
Related
Approvals
Add human gates to workflows that touch production certificates.
Notifications
Wire workflow events into Slack, PagerDuty, or webhooks.
Alerts
Turn alert rules into workflow triggers.