Register Workflow Connector

POST/api/v1/workflows/dispatch

Request

curl -X POST "<BASE_URL>/api/v1/workflows/dispatch" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "X-CQRS-Action: REGISTER_WORKFLOW_CONNECTOR" \
  -H "Content-Type: application/json" \
  -d '{
    "auth_kind": "NO_AUTH",
    "connector_kind": "string",
    "ip_allowlist": [
      "string"
    ],
    "refresh_strategy": "O_AUTH2",
    "registered_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "secret_ref": {
      "path": "string",
      "vault": "HASHI_CORP_VAULT",
      "version": 1
    },
    "tenant_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "ttl_seconds": 1
  }'

Authorization

Minimum role: Tenant administratorThe caller must hold this role or a higher one.
Action: REGISTER_WORKFLOW_CONNECTOR

Headers

AuthorizationstringRequired
Access token of the signed-in user, as a Bearer token. It identifies the user, their role and the workspace.
X-CQRS-ActionstringRequired
Names the command to run. Must be REGISTER_WORKFLOW_CONNECTOR for this endpoint.
Content-TypestringRequired
Always application/json.
X-Idempotency-KeystringOptional
A key you choose that is unique to this attempt. A command repeated with the same key is not applied a second time.
X-Correlation-IdstringOptional
Your own identifier for the request. Returned in the x-correlation-id response header; generated when you leave it out.

Request body

auth_kindenumRequired
ConnectorCredential.auth_kind. NoAuth for public endpoints; Mtls for finance / health connectors that require client certs.
Allowed values
- NO_AUTH
- BASIC
- API_KEY
- O_AUTH2
- BEARER
- HMAC
- MTLS
connector_kindstringRequired
No description yet.
ip_allowlistarray of stringRequired
No description yet.
refresh_strategyenumRequired
ConnectorCredential.refresh_strategy. WorkloadIdentity preferred per Vault best practice (no static creds, no manual rotation).
Allowed values
- O_AUTH2
- STS_ASSUME_ROLE
- WORKLOAD_IDENTITY
- STATIC_API_KEY
registered_byuuidRequired
No description yet.
secret_refobjectRequired
Vault-backed credential reference. The engine resolves it through the secrets_store port — the resolver returns short-lived SecretMaterial, never stores it, and logs only the ref.
3 child fields
- pathstringRequired
  No description yet.
- vaultenumRequired
  SecretRef.vault. Multi-vendor secrets backend support; v1 ships HashiCorpVault with the trait scaffolded for the other three.
  Allowed values
  HASHI_CORP_VAULT
  AWS_SECRETS_MANAGER
  GCP_SECRET_MANAGER
  AZURE_KEY_VAULT
- versionintegerRequired
  Vault version. Mutated atomically by RotateSecretRefCommand.
  at least 0
tenant_iduuidRequired
No description yet.
ttl_secondsintegerRequired
No description yet.
at least 0
openapi_spec_refstring or nullOptional
No description yet.

Response

Status 202. The command was applied. The body reports the outcome and, where the command changes a record, that record's new state.

successbooleanRequired
true when the command was applied.
error_messagestringRequired
Empty when the command was applied.
projected_stateobjectOptional
The record as it stands after the command.
event_payloadobjectOptional
The event the command recorded.
insightsarray of objectOptional
Advisory notes about the result. Each has a code, a message and an impact number.

Errors

Every error carries an HTTP status. Where it also carries a code, branch on the code, not on the message.

400X-CQRS-Action is missing or names a command this route does not accept. Send REGISTER_WORKFLOW_CONNECTOR.
400DOMAIN_ROUTINGThe body is not a valid command. Check the required fields and their types.
401The access token is missing, expired or not valid.
401L1_AUTHThe caller's role is below tenantadmin or the caller has no access to this record.
403L1_POLICYA business rule refused the command. The message names the rule.
409L1_IDEMPOTENCYA command with this idempotency key was already applied.
409CONFLICTThe command would duplicate a record that must be unique.
500L3_COMMITThe command was valid but could not be saved.