GET /v1/organizations/{org_id}/projects/{id}/workflows

A project’s automation workflows (trigger → conditions → actions) and the history of their runs.

List workflows

GET /api/v1/organizations/{org_id}/projects/{project_id}/workflows
Authorization: Bearer twa_your_key_here

Path Parameters

Parameter	Type	Description
org_id	UUID	Organization identifier
project_id	UUID	Project identifier

Response 200 OK

[
  {
    "id": "018e8888-0000-7000-8000-000000000040",
    "name": "Default workflow",
    "is_enabled": true,
    "is_default": true,
    "created_at": "2024-03-15T10:22:00Z",
    "updated_at": "2024-06-01T08:00:00Z"
  }
]

Fields

Field	Type	Description
id	string (UUID)	Workflow identifier
name	string	Name
is_enabled	boolean	Workflow active
is_default	boolean	Project’s default workflow
created_at	string (ISO 8601)	Creation date
updated_at	string (ISO 8601)	Last change

The list does not include the graph.

No single-workflow read on /v1

GET /api/v1/organizations/{org_id}/projects/{project_id}/workflows/{workflow_id} does not exist. To read a workflow with its graph:

• the MCP tool get_workflow;
• the session API (cookie or account token, not a twa_ key): GET /projects/{project_id}/workflows/{workflow_id}. An organization workflow is GET /organizations/{org_id}/workflows/{workflow_id}.

Create a workflow

POST /api/v1/organizations/{org_id}/projects/{project_id}/workflows
Authorization: Bearer twa_your_key_here
Idempotency-Key: 018e9999-0000-7000-8000-000000000099
Content-Type: application/json

Scope workflows-write, granted explicitly on the key. Missing header: 422. The same key and the same body return the workflow already created (200); a different body with the same key: 409.

Body: name (required), description, and either graph (nodes and edges) or trigger, actions and create_case (default true). Both forms together: 422.

Response 201: the full record (id, name, description, is_enabled, is_default, family, version, graph, created_at, updated_at). A name already used on the project: 409.

Update a workflow

PATCH /api/v1/organizations/{org_id}/projects/{project_id}/workflows/{workflow_id}
Authorization: Bearer twa_your_key_here
Content-Type: application/json

Scope workflows-write. version is required: if it no longer matches the record, 409 (version_perimee; the response includes the current version). Fields: name, description, version, and either graph or trigger, actions, create_case.

Enable or disable

PATCH /api/v1/organizations/{org_id}/projects/{project_id}/workflows/{workflow_id}/enabled
Authorization: Bearer twa_your_key_here
Content-Type: application/json

{ "enabled": false }

Scope workflows-write. Response: the record, with version incremented.

Delete a workflow

DELETE /api/v1/organizations/{org_id}/projects/{project_id}/workflows/{workflow_id}
Authorization: Bearer twa_your_key_here

Scope workflows-write. Response 204. 409 if it is the project’s default workflow, or the last one on the project.

Run history

GET /api/v1/organizations/{org_id}/projects/{project_id}/workflows/{workflow_id}/runs
Authorization: Bearer twa_your_key_here

Query Parameters

Parameter	Type	Description
limit	integer	Number of runs, max 200 (default 50)

Response 200 OK

[
  {
    "id": "018e8888-0000-7000-8000-000000000041",
    "workflow_id": "018e8888-0000-7000-8000-000000000040",
    "trigger_event": "cve.new_match",
    "cve_id": "CVE-2024-3094",
    "status": "success",
    "started_at": "2024-07-01T06:05:00Z",
    "finished_at": "2024-07-01T06:05:02Z"
  }
]

Fields — Run

Field	Type	Description
id	string (UUID)	Run identifier
workflow_id	string (UUID)	Executed workflow
trigger_event	string	Trigger event (e.g. cve.new_match)
cve_id	string | null	Related CVE
status	string	success, partial, failed, throttled, dry_run
started_at	string (ISO 8601)	Start
finished_at	string (ISO 8601) | null	End (null if running)

Errors

Code	Detail	Cause
404	Projet introuvable	Project does not exist, belongs to another organization, or is outside the key’s project restriction
404	Workflow introuvable	workflow_id not found on this project

Example

Latest failed runs

ORG_ID="018e5678-abcd-7000-8000-000000000001"
PROJECT_ID="018e1234-abcd-7000-8000-000000000010"
WORKFLOW_ID="018e8888-0000-7000-8000-000000000040"

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  "https://app.techwatchalert.com/api/v1/organizations/${ORG_ID}/projects/${PROJECT_ID}/workflows/${WORKFLOW_ID}/runs?limit=100" \
  | jq '.[] | select(.status == "failed" or .status == "partial") | {cve_id, status, started_at}'