Update Workflow Definition

Update a Draft workflow definition. Bumps version by 1.

POST/api/v1/workflows/dispatch

Request

curl -X POST "<BASE_URL>/api/v1/workflows/dispatch" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "X-CQRS-Action: UPDATE_WORKFLOW_DEFINITION" \
  -H "Content-Type: application/json" \
  -d '{
    "definition_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "expected_version": 1,
    "tenant_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "updated_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }'

Authorization

Minimum role: ManagerThe caller must hold this role or a higher one.
Action: UPDATE_WORKFLOW_DEFINITION

Headers

AuthorizationstringRequired
Access token of the signed-in user, as a Bearer token. It identifies the user, their role and the workspace.
X-CQRS-ActionstringRequired
Names the command to run. Must be UPDATE_WORKFLOW_DEFINITION for this endpoint.
Content-TypestringRequired
Always application/json.
X-Idempotency-KeystringOptional
A key you choose that is unique to this attempt. A command repeated with the same key is not applied a second time.
X-Correlation-IdstringOptional
Your own identifier for the request. Returned in the x-correlation-id response header; generated when you leave it out.

Request body

definition_iduuidRequired
No description yet.
expected_versionintegerRequired
No description yet.
tenant_iduuidRequired
No description yet.
updated_byuuidRequired
No description yet.
dagobject or nullOptional
No description yet.
3 child fields
- edgesarray of objectRequired
  No description yet.
  6 child fields
  fromNodeIdstringRequired
  No description yet.
  idstringRequired
  No description yet.
  toNodeIdstringRequired
  No description yet.
  conditionobject or nullOptional
  No description yet.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
  roleenumOptional
  Branch-edge role marker. Lets the runner distinguish a TrueBranch from a FalseBranch on a DecisionNode and the success vs failure path on a step with boundary events attached.
  Allowed values
  ELSE
  TRUE_BRANCH
  FALSE_BRANCH
  SUCCESS
  FAILURE
  COMPENSATION
  Default
  ELSE
  traceIdstring or nullOptional
  No description yet.
- startStepIdstringRequired
  The step the executor should begin from.
- stepsarray of objectRequired
  No description yet.
  16 child fields
  configanyRequired
  No description yet.
  errorPolicyenumRequired
  No description yet.
  Allowed values
  RETRY
  ABORT
  ESCALATE
  COMPENSATE
  CATCH_BLOCK
  DEAD_LETTER
  CUSTOM_HANDLER
  DEAD_LETTER
  Skip retries entirely; route immediately to the dead-letter queue. Used for "fail loud" connectors where a retry storm would be worse than a missed message.
  idstringRequired
  No description yet.
  metadataobjectRequired
  No description yet.
  2 child fields
  xintegerRequired
  No description yet.
  yintegerRequired
  No description yet.
  namestringRequired
  No description yet.
  typeenumRequired
  No description yet.
  Allowed values
  TRIGGER
  CONDITION
  ACTION
  AGENT_TASK
  AI_EVALUATION
  RAG_ENRICHMENT
  COMPENSATION
  REAL_TIME_STREAM
  DECISION
  SWITCH
  PARALLEL_GATEWAY
  INCLUSIVE_GATEWAY
  FOR_EACH
  WAIT
  APPROVAL_GATE
  SCREEN_FORM
  HTTP_CALLOUT
  SUB_WORKFLOW
  COMPENSATE_BOUNDARY
  ERROR_BOUNDARY
  SIGNAL_CATCH
  DATA_TRANSFORM
  SET_VARIABLE
  AGENT_CHAT_TURN
  MESSAGE_CATCH_EVENT
  CONTINUE_AS_NEW
  DYNAMIC_FORK
  EXIT_HANDLER
  ACQUIRE_LOCK
  FEATURE_FLAG_GATE
  RAG_CITATION_CHECK
  AGENT_PANEL_VOTE
  CITATION_BOUNDING_BOX
  CALL
  MEETING
  RESEARCH
  POLICY
  CUSTOM_CODE
  AI_CLASSIFY_BRANCH
  CUSTOM_CODE
  CustomCode runs in deterministic WASM (no syscalls, no fs, no network except declared SecretRef + HttpCallout subhandle). Replay-safe by construction.
  AI_CLASSIFY_BRANCH
  AI-advisory branch. binding: false on the node config is the L1 deterministic gate invariant — L1 re-validates before commit.
  allowedRegionsarray of enumOptional
  Sovereign routing constraint — step must execute in one of these regions. Empty = no constraint.
  Allowed values
  US
  EU
  APAC
  bindingbooleanOptional
  No description yet.
  Default
  false
  boundaryEventsarray of objectOptional
  Camunda BPMN-style boundary events attached to this step.
  5 child fields
  attachedToStepIdstringRequired
  No description yet.
  cancelActivitybooleanRequired
  No description yet.
  handlerNextStepIdstringRequired
  No description yet.
  kindenumRequired
  Boundary event taxonomy (Camunda BPMN model). Each instance attaches to a DagStep with cancel_activity: bool deciding interrupting vs non-interrupting semantics.
  Allowed values
  ERROR
  TIMER
  SIGNAL
  COMPENSATE
  ESCALATION
  CANCEL
  MESSAGE
  matchCodestring or nullOptional
  Filters by error code or signal name. None = catch-all.
  budgetStateobject or nullOptional
  Live circuit-breaker + consumption state for cost-bounded actions.
  5 child fields
  breakerFailureCountintegerRequired
  No description yet.
  at least 0
  breakerStateenumRequired
  Standard circuit-breaker triad. Co-located with BudgetEnvelope.
  Allowed values
  CLOSED
  OPEN
  HALF_OPEN
  consumedUsdMicrosintegerRequired
  No description yet.
  remainingUsdMicrosintegerRequired
  No description yet.
  breakerOpensUntildate-time or nullOptional
  No description yet.
  inputSchemaobject or nullOptional
  Typed input contract — what shape the node consumes. Save-time edge_type_check enforces producer.output_schema ⊆ consumer.input_schema.
  2 child fields
  inlineanyOptional
  No description yet.
  refIdstring or nullOptional
  No description yet.
  meddpiccFocusenum or nullOptional
  Which MEDDPICC qualification step this advances.
  Allowed values
  METRICS
  ECONOMIC_BUYER
  DECISION_CRITERIA
  DECISION_PROCESS
  PAPER_PROCESS
  IDENTIFY_PAIN
  CHAMPION
  COMPETITION
  outputSchemaobject or nullOptional
  Typed output contract — what shape the node produces.
  2 child fields
  inlineanyOptional
  No description yet.
  refIdstring or nullOptional
  No description yet.
  retryPolicyobject or nullOptional
  Per-step retry policy. Overrides the workflow-level default.
  4 child fields
  backoffenumRequired
  RetryPolicy.backoff — backoff curve between retry attempts.
  Allowed values
  EXPONENTIAL
  LINEAR
  FIXED
  baseIntervalMsintegerRequired
  No description yet.
  at least 0
  maxAttemptsintegerRequired
  No description yet.
  at least 0
  maxIntervalMsintegerRequired
  No description yet.
  at least 0
  targetPersonalityenum or nullOptional
  Which communication style this step is pitched at.
  Allowed values
  ANALYTICAL
  DRIVER
  AMIABLE
  EXPRESSIVE
  timeoutSecondsinteger or nullOptional
  No description yet.
  at least 0
dedupe_keystring or nullOptional
No description yet.
enrollmentobject or nullOptional
Entry criteria + dedupe key + mode. Attached to a WorkflowDefinition; the runtime evaluator reads it on every candidate event.
3 child fields
- modeenumRequired
  Per-entity enrollment policy. Drives whether enrollment_service (Layer 6) admits the same record into the workflow more than once.
  Allowed values
  ONCE
  RE_ENROLL_ON_RE_ENTRY
  ALWAYS_RE_ENROLL
  ONCE
  First enrollment wins — subsequent matches are dropped.
  RE_ENROLL_ON_RE_ENTRY
  Re-enroll only after the record exited the workflow (Completed / Goal / Suppressed). Default for "lifecycle nurture" templates.
  ALWAYS_RE_ENROLL
  Re-enroll every time the trigger matches, even mid-run. Use only for "always-on" alerts where overlapping runs are intentional.
- predicatesarray of objectRequired
  AND'd predicates the candidate record must satisfy. Empty means "any record matched by the trigger qualifies" — useful for always-on workflows.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
- dedupeFieldstring or nullOptional
  Field name on the candidate record whose value gets hashed via PiiEncryptor to produce EnrollmentRecord.dedupe_digest. Empty means "use the record id" — safe default for most aggregates.
goalobject or nullOptional
Goal that ends an enrollment when met. Optional on the definition (workflows can run forever); when set, the evaluator emits a goal_completion event and enrollment_service writes EnrollmentRecord.exit_reason = "goal_completion".
3 child fields
- kindenumRequired
  What an enrollment is trying to achieve. The goal evaluator on enrollment_service exits the enrollment when the kind's predicate fires — goal_completion becomes the terminal exit_reason.
  Allowed values
  FIELD_VALUE
  RECORD_STATUS
  AGGREGATE_THRESHOLD
  AI_PREDICATE
  FIELD_VALUE
  Field on the enrolled record reaches target_value.
  RECORD_STATUS
  Record's lifecycle/status reaches target_value.
  AGGREGATE_THRESHOLD
  Aggregate across the tenant (e.g. "tenant MRR ≥ $50k") satisfies the threshold. Useful for marketing nurture campaigns.
  AI_PREDICATE
  AI evaluator (l2_cognitive_react) returns confidence ≥ threshold. Carries outsmart-D's XaiProvenance on the goal-completion event.
- predicateobjectRequired
  No description yet.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
- attributionWindowDaysinteger or nullOptional
  Delay after admission before the enrolled subject's outcome is observed. Each admission registers its own observation atomically. None disables delayed attribution; the predicate still controls enrollment completion.
  at least 0
patchobject or nullOptional
Explicit set/clear semantics. Legacy optional fields above remain supported.
14 child fields
- autonomyLevelenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setenumRequired
  No description yet.
  Allowed values
  OBSERVE
  ADVISE
  ACT_WITH_APPROVAL
  ACT_AUTONOMOUSLY
- complianceEnvelopeenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  No description yet.
  14 child fields
  classificationenumRequired
  ISO 27001 data classification; drives the DLP gate.
  Allowed values
  PUBLIC
  INTERNAL
  CONFIDENTIAL
  RESTRICTED
  containsPhibooleanRequired
  HIPAA 45 CFR 164.312(b) gate. If true, every DecisionSpan emitted by runs of this workflow MUST include actor + access justification.
  dataCategoriesarray of enumRequired
  No description yet.
  Allowed values
  PERSONAL_IDENTIFIER
  FINANCIAL_RECORD
  HEALTH_RECORD
  BEHAVIORAL_DATA
  CONTACT_INFO
  EMPLOYMENT_RECORD
  COMMUNICATION_CONTENT
  DEVICE_TELEMETRY
  legalBasisenumRequired
  No description yet.
  Allowed values
  CONSENT
  CONTRACT
  LEGAL_OBLIGATION
  VITAL_INTERESTS
  PUBLIC_TASK
  LEGITIMATE_INTERESTS
  processingPurposestringRequired
  Article 30 RoPA purpose field.
  recipientsarray of stringRequired
  Article 30 RoPA recipients — third parties receiving the processed data.
  retentionBasisstringRequired
  No description yet.
  retentionDurationDaysintegerRequired
  No description yet.
  at least 0
  crossBorderDestinationenum or nullOptional
  If set + differs from WorkflowDefinition.region, the bridge requires cross_border_safeguard to be set.
  Allowed values
  US
  EU
  APAC
  crossBorderSafeguardenum or nullOptional
  GDPR Chapter V cross-border safeguard taxonomy. Required when ComplianceEnvelope.cross_border_destination is set — the bridge rejects cross-region dispatch otherwise.
  Allowed values
  SCC
  BCR
  ADEQUACY_DECISION
  DEROGATION_ART49
  definitionIduuidOptional
  No description yet.
  Default
  00000000-0000-0000-0000-000000000000
  iduuidOptional
  No description yet.
  Default
  00000000-0000-0000-0000-000000000000
  minimumNecessaryJustificationstring or nullOptional
  No description yet.
  tenantIduuidOptional
  No description yet.
  Default
  00000000-0000-0000-0000-000000000000
- controlGroupPctBpenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setintegerRequired
  No description yet.
  at least 0
- dagenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  No description yet.
  3 child fields
  edgesarray of objectRequired
  No description yet.
  6 child fields
  fromNodeIdstringRequired
  No description yet.
  idstringRequired
  No description yet.
  toNodeIdstringRequired
  No description yet.
  conditionobject or nullOptional
  No description yet.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
  roleenumOptional
  Branch-edge role marker. Lets the runner distinguish a TrueBranch from a FalseBranch on a DecisionNode and the success vs failure path on a step with boundary events attached.
  Allowed values
  ELSE
  TRUE_BRANCH
  FALSE_BRANCH
  SUCCESS
  FAILURE
  COMPENSATION
  Default
  ELSE
  traceIdstring or nullOptional
  No description yet.
  startStepIdstringRequired
  The step the executor should begin from.
  stepsarray of objectRequired
  No description yet.
  16 child fields
  configanyRequired
  No description yet.
  errorPolicyenumRequired
  No description yet.
  Allowed values
  RETRY
  ABORT
  ESCALATE
  COMPENSATE
  CATCH_BLOCK
  DEAD_LETTER
  CUSTOM_HANDLER
  DEAD_LETTER
  Skip retries entirely; route immediately to the dead-letter queue. Used for "fail loud" connectors where a retry storm would be worse than a missed message.
  idstringRequired
  No description yet.
  metadataobjectRequired
  No description yet.
  2 child fields
  xintegerRequired
  No description yet.
  yintegerRequired
  No description yet.
  namestringRequired
  No description yet.
  typeenumRequired
  No description yet.
  Allowed values
  TRIGGER
  CONDITION
  ACTION
  AGENT_TASK
  AI_EVALUATION
  RAG_ENRICHMENT
  COMPENSATION
  REAL_TIME_STREAM
  DECISION
  SWITCH
  PARALLEL_GATEWAY
  INCLUSIVE_GATEWAY
  FOR_EACH
  WAIT
  APPROVAL_GATE
  SCREEN_FORM
  HTTP_CALLOUT
  SUB_WORKFLOW
  COMPENSATE_BOUNDARY
  ERROR_BOUNDARY
  SIGNAL_CATCH
  DATA_TRANSFORM
  SET_VARIABLE
  AGENT_CHAT_TURN
  MESSAGE_CATCH_EVENT
  CONTINUE_AS_NEW
  DYNAMIC_FORK
  EXIT_HANDLER
  ACQUIRE_LOCK
  FEATURE_FLAG_GATE
  RAG_CITATION_CHECK
  AGENT_PANEL_VOTE
  CITATION_BOUNDING_BOX
  CALL
  MEETING
  RESEARCH
  POLICY
  CUSTOM_CODE
  AI_CLASSIFY_BRANCH
  CUSTOM_CODE
  CustomCode runs in deterministic WASM (no syscalls, no fs, no network except declared SecretRef + HttpCallout subhandle). Replay-safe by construction.
  AI_CLASSIFY_BRANCH
  AI-advisory branch. binding: false on the node config is the L1 deterministic gate invariant — L1 re-validates before commit.
  allowedRegionsarray of enumOptional
  Sovereign routing constraint — step must execute in one of these regions. Empty = no constraint.
  Allowed values
  US
  EU
  APAC
  bindingbooleanOptional
  No description yet.
  Default
  false
  boundaryEventsarray of objectOptional
  Camunda BPMN-style boundary events attached to this step.
  budgetStateobject or nullOptional
  Live circuit-breaker + consumption state for cost-bounded actions.
  5 child fields
  breakerFailureCountintegerRequired
  No description yet.
  at least 0
  breakerStateenumRequired
  Standard circuit-breaker triad. Co-located with BudgetEnvelope.
  Allowed values
  CLOSED
  OPEN
  HALF_OPEN
  consumedUsdMicrosintegerRequired
  No description yet.
  remainingUsdMicrosintegerRequired
  No description yet.
  breakerOpensUntildate-time or nullOptional
  No description yet.
  inputSchemaobject or nullOptional
  Typed input contract — what shape the node consumes. Save-time edge_type_check enforces producer.output_schema ⊆ consumer.input_schema.
  2 child fields
  inlineanyOptional
  No description yet.
  refIdstring or nullOptional
  No description yet.
  meddpiccFocusenum or nullOptional
  Which MEDDPICC qualification step this advances.
  Allowed values
  METRICS
  ECONOMIC_BUYER
  DECISION_CRITERIA
  DECISION_PROCESS
  PAPER_PROCESS
  IDENTIFY_PAIN
  CHAMPION
  COMPETITION
  outputSchemaobject or nullOptional
  Typed output contract — what shape the node produces.
  2 child fields
  inlineanyOptional
  No description yet.
  refIdstring or nullOptional
  No description yet.
  retryPolicyobject or nullOptional
  Per-step retry policy. Overrides the workflow-level default.
  4 child fields
  backoffenumRequired
  RetryPolicy.backoff — backoff curve between retry attempts.
  Allowed values
  EXPONENTIAL
  LINEAR
  FIXED
  baseIntervalMsintegerRequired
  No description yet.
  at least 0
  maxAttemptsintegerRequired
  No description yet.
  at least 0
  maxIntervalMsintegerRequired
  No description yet.
  at least 0
  targetPersonalityenum or nullOptional
  Which communication style this step is pitched at.
  Allowed values
  ANALYTICAL
  DRIVER
  AMIABLE
  EXPRESSIVE
  timeoutSecondsinteger or nullOptional
  No description yet.
  at least 0
- dedupeKeyenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setstringRequired
  No description yet.
- descriptionenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setstringRequired
  No description yet.
- enrollmentenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  Entry criteria + dedupe key + mode. Attached to a WorkflowDefinition; the runtime evaluator reads it on every candidate event.
  3 child fields
  modeenumRequired
  Per-entity enrollment policy. Drives whether enrollment_service (Layer 6) admits the same record into the workflow more than once.
  Allowed values
  ONCE
  RE_ENROLL_ON_RE_ENTRY
  ALWAYS_RE_ENROLL
  ONCE
  First enrollment wins — subsequent matches are dropped.
  RE_ENROLL_ON_RE_ENTRY
  Re-enroll only after the record exited the workflow (Completed / Goal / Suppressed). Default for "lifecycle nurture" templates.
  ALWAYS_RE_ENROLL
  Re-enroll every time the trigger matches, even mid-run. Use only for "always-on" alerts where overlapping runs are intentional.
  predicatesarray of objectRequired
  AND'd predicates the candidate record must satisfy. Empty means "any record matched by the trigger qualifies" — useful for always-on workflows.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
  dedupeFieldstring or nullOptional
  Field name on the candidate record whose value gets hashed via PiiEncryptor to produce EnrollmentRecord.dedupe_digest. Empty means "use the record id" — safe default for most aggregates.
- goalenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  Goal that ends an enrollment when met. Optional on the definition (workflows can run forever); when set, the evaluator emits a goal_completion event and enrollment_service writes EnrollmentRecord.exit_reason = "goal_completion".
  3 child fields
  kindenumRequired
  What an enrollment is trying to achieve. The goal evaluator on enrollment_service exits the enrollment when the kind's predicate fires — goal_completion becomes the terminal exit_reason.
  Allowed values
  FIELD_VALUE
  RECORD_STATUS
  AGGREGATE_THRESHOLD
  AI_PREDICATE
  FIELD_VALUE
  Field on the enrolled record reaches target_value.
  RECORD_STATUS
  Record's lifecycle/status reaches target_value.
  AGGREGATE_THRESHOLD
  Aggregate across the tenant (e.g. "tenant MRR ≥ $50k") satisfies the threshold. Useful for marketing nurture campaigns.
  AI_PREDICATE
  AI evaluator (l2_cognitive_react) returns confidence ≥ threshold. Carries outsmart-D's XaiProvenance on the goal-completion event.
  predicateobjectRequired
  No description yet.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
  attributionWindowDaysinteger or nullOptional
  Delay after admission before the enrolled subject's outcome is observed. Each admission registers its own observation atomically. None disables delayed attribution; the predicate still controls enrollment completion.
  at least 0
- learningGuardrailsenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  No description yet.
  3 child fields
  proxyMetricenumRequired
  What the loop optimizes. Anything short of ClosedWon is a proxy.
  Allowed values
  REPLY_RATE
  MEETING_BOOKED
  STAGE_ADVANCE
  CLOSED_WON
  stopPolicyenumRequired
  What happens at the cap. Off blocks ActAutonomously.
  Allowed values
  EARLY_STOP_ON_DIVERGENCE
  PRESSURE_CAP
  OFF
  divergenceCapBpinteger or nullOptional
  Max tolerated proxy-vs-outcome divergence in basis points before the stop policy fires. Ignored when proxy_metric == ClosedWon.
  at least 0
- monitoringSpecenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  No description yet.
  5 child fields
  autoDegradeenumRequired
  No description yet.
  Allowed values
  NONE
  PAUSE_NEW_ENROLLMENT
  DOWNGRADE_AUTONOMY_ONE_LEVEL
  DRAIN_ALL
  monitoredSignalsarray of enumRequired
  No description yet.
  Allowed values
  COST_PER_STEP
  LATENCY
  TOOL_ERROR_RATE
  GUARDRAIL_VIOLATIONS
  LOOP_DETECTION
  OUTPUT_DRIFT
  PII_LEAKAGE
  alertPolicyanyOptional
  Per-signal warn/critical thresholds + destinations. Free-shape JSON in v1 (threshold values are deployment-specific, not citable constants).
  contentCaptureenumOptional
  No description yet.
  Allowed values
  OFF
  OPT_IN_REDACTED
  Default
  OFF
  logRetentionDaysinteger or nullOptional
  Art. 26(6) floor is 6 months for high-risk systems; default 180.
  at least 0
- nameenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setstringRequired
  No description yet.
- oversightenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  No description yet.
  6 child fields
  owneruuidRequired
  No description yet.
  approvalScopearray of enumOptional
  No description yet.
  Allowed values
  PROMOTE
  RESTORE_AUTONOMY
  CLOSE_INCIDENT
  RECERTIFY
  backupuuid or nullOptional
  Delegation / vacation coverage. Required at ActAutonomously.
  biasAwarenessAckbooleanOptional
  Art. 14(4)(b) — automation-bias awareness acknowledged at assignment. Required at ActAutonomously.
  Default
  false
  escalationSlaMinutesinteger or nullOptional
  Time to acknowledge an escalation before it falls to the backup.
  at least 0
  recertIntervalDaysinteger or nullOptional
  Periodic re-attestation cadence.
  at least 0
- suppressionenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setobjectRequired
  A suppression list ref. When scope != None, the runtime consults the named list before enrolling and blocks matches.
  2 child fields
  listNamestringRequired
  No description yet.
  scopeenumRequired
  Where the suppression list applies. Resolved by enrollment_service before dedupe — a Region-scoped suppression blocks every tenant in that region from enrolling the record.
  Allowed values
  NONE
  TENANT
  REGION
  GLOBAL
  REGION
  Outsmart-B — region-scoped suppression keeps EU PII rules enforceable across every tenant under the same IdentityRegion.
  GLOBAL
  Reserved for support-driven blanket bans (e.g. abuse reports). SuperAdmin role required to apply.
- triggersenum or objectOptional
  Explicit partial update: omission preserves, clear removes, set replaces.
  Allowed values
  unchanged
  clear
  Default
  unchanged
  1 child fields
  setarray of objectRequired
  No description yet.
  5 child fields
  domainstringRequired
  Owning domain (e.g. "leads", "deals"). The dispatcher only considers events from this domain; cross-domain triggers compose via multiple WorkflowTrigger entries.
  kindenumRequired
  No description yet.
  Allowed values
  MANUAL
  RECORD_CREATED
  RECORD_UPDATED
  RECORD_DELETED
  FIELD_CHANGED
  SCHEDULE
  EVENT_RECEIVED
  AI_SUGGESTED
  cronExpressionstring or nullOptional
  Optional cron expression for Schedule triggers (e.g. "0 9 * * 1-5").
  intervalSecondsinteger or nullOptional
  Optional recurring interval in seconds for Schedule triggers (e.g. 86400).
  at least 0
  predicateobject or nullOptional
  Optional predicate. None ⇒ any event of kind for domain matches (no field filter). Some(_) ⇒ event payload must satisfy the condition.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.
suppressionobject or nullOptional
A suppression list ref. When scope != None, the runtime consults the named list before enrolling and blocks matches.
2 child fields
- listNamestringRequired
  No description yet.
- scopeenumRequired
  Where the suppression list applies. Resolved by enrollment_service before dedupe — a Region-scoped suppression blocks every tenant in that region from enrolling the record.
  Allowed values
  NONE
  TENANT
  REGION
  GLOBAL
  REGION
  Outsmart-B — region-scoped suppression keeps EU PII rules enforceable across every tenant under the same IdentityRegion.
  GLOBAL
  Reserved for support-driven blanket bans (e.g. abuse reports). SuperAdmin role required to apply.
triggersarray of object or nullOptional
No description yet.
5 child fields
- domainstringRequired
  Owning domain (e.g. "leads", "deals"). The dispatcher only considers events from this domain; cross-domain triggers compose via multiple WorkflowTrigger entries.
- kindenumRequired
  No description yet.
  Allowed values
  MANUAL
  RECORD_CREATED
  RECORD_UPDATED
  RECORD_DELETED
  FIELD_CHANGED
  SCHEDULE
  EVENT_RECEIVED
  AI_SUGGESTED
- cronExpressionstring or nullOptional
  Optional cron expression for Schedule triggers (e.g. "0 9 * * 1-5").
- intervalSecondsinteger or nullOptional
  Optional recurring interval in seconds for Schedule triggers (e.g. 86400).
  at least 0
- predicateobject or nullOptional
  Optional predicate. None ⇒ any event of kind for domain matches (no field filter). Some(_) ⇒ event payload must satisfy the condition.
  3 child fields
  fieldstringRequired
  No description yet.
  operatorenumRequired
  No description yet.
  Allowed values
  EQUALS
  NOT_EQUALS
  GREATER_THAN
  LESS_THAN
  CONTAINS
  IN
  EXISTS
  valueanyRequired
  No description yet.

Response

Status 202. The command was applied. The body reports the outcome and, where the command changes a record, that record's new state.

successbooleanRequired
true when the command was applied.
error_messagestringRequired
Empty when the command was applied.
projected_stateobjectOptional
The record as it stands after the command.
event_payloadobjectOptional
The event the command recorded.
insightsarray of objectOptional
Advisory notes about the result. Each has a code, a message and an impact number.

Errors

Every error carries an HTTP status. Where it also carries a code, branch on the code, not on the message.

400X-CQRS-Action is missing or names a command this route does not accept. Send UPDATE_WORKFLOW_DEFINITION.
400DOMAIN_ROUTINGThe body is not a valid command. Check the required fields and their types.
401The access token is missing, expired or not valid.
401L1_AUTHThe caller's role is below manager or the caller has no access to this record.
403L1_POLICYA business rule refused the command. The message names the rule.
409L1_VERSIONexpected_version is not the record's current version. Read the record again, then retry.
409L1_IDEMPOTENCYA command with this idempotency key was already applied.
409CONFLICTThe command would duplicate a record that must be unique.
500L3_COMMITThe command was valid but could not be saved.