Field guide / Workflows APIReviewable source / main

Workflows API

Workflow contract reads: per-workflow deployment/dry-run contracts and preflight decision surfaces.

6 routes

Response metadata: x-api-version, x-request-id, and traceresponse apply to normal routed responses and are omitted from the per-operation header tables below.

GET`/api/workflows/application-environment/deployment-contract`

request access

Workflows app env deployment.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/application-environment/deployment-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`liveExecutionEnabled`	`boolean`	Required	Value of `liveExecutionEnabled` returned in the response body.
`deploymentPlans`	`array<JSON value>`	Required	Value of `deploymentPlans` returned in the response body.
`tiers`	`array<JSON value>`	Required	Value of `tiers` returned in the response body.
`supportedHypervisors`	`array<JSON value>`	Required	Value of `supportedHypervisors` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/application-environment/deployment-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "deploymentPlans": [],
  "tiers": [],
  "supportedHypervisors": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET`/api/workflows/application-environment/retirement-contract`

request access

Workflows app env retirement.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/application-environment/retirement-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`liveExecutionEnabled`	`boolean`	Required	Value of `liveExecutionEnabled` returned in the response body.
`phases`	`array<JSON value>`	Required	Value of `phases` returned in the response body.
`domains`	`array<JSON value>`	Required	Value of `domains` returned in the response body.
`supportedHypervisors`	`array<JSON value>`	Required	Value of `supportedHypervisors` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/application-environment/retirement-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "phases": [],
  "domains": [],
  "supportedHypervisors": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET`/api/workflows/azure-landing-zone/validation-contract`

request access

Workflows azure lz.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/azure-landing-zone/validation-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`validationSurfaces`	`array<JSON value>`	Required	Value of `validationSurfaces` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/azure-landing-zone/validation-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "validationSurfaces": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET`/api/workflows/preflight/local/decision`

audit access

Workflows preflight local decision.

Permissions

Access class	Credential	Scoping
`audit`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/preflight/local/decision

Path parameters

This operation has no path parameters.

Query parameters

Name	Type	Requirement	Description
`requestedOffering`	`string`	Optional	Value supplied for the `requestedOffering` query parameter.
`owner`	`string`	Optional	Value supplied for the `owner` query parameter.
`site`	`string`	Optional	Site identifier used to scope or filter the operation.
`environment`	`string`	Optional	Environment identifier used to scope or filter the operation.
`criticality`	`string`	Optional	Value supplied for the `criticality` query parameter.
`dryRunPlan`	`string`	Optional	Value supplied for the `dryRunPlan` query parameter.
`approvalRoute`	`string`	Optional	Value supplied for the `approvalRoute` query parameter.
`evidenceManifest`	`string`	Optional	Value supplied for the `evidenceManifest` query parameter.
`secretReferenceState`	`string`	Optional	Value supplied for the `secretReferenceState` query parameter.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`liveExecutionAllowed`	`boolean`	Required	Value of `liveExecutionAllowed` returned in the response body.
`decision`	`JSON value`	Required	Value of `decision` returned in the response body.
`status`	`JSON value`	Required	Current operation or resource status.
`requestedOffering`	`JSON value`	Required	Value of `requestedOffering` returned in the response body.
`requiredInputs`	`array<JSON value>`	Required	Value of `requiredInputs` returned in the response body.
`missingInputs`	`JSON value`	Required	Value of `missingInputs` returned in the response body.
`guardBlocks`	`JSON value`	Required	Value of `guardBlocks` returned in the response body.
`remediation`	`JSON value`	Required	Value of `remediation` returned in the response body.
`evidence`	`array<JSON value>`	Required	Value of `evidence` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/preflight/local/decision'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionAllowed": false,
  "decision": null,
  "status": null,
  "requestedOffering": null,
  "requiredInputs": [],
  "missingInputs": null,
  "guardBlocks": null,
  "remediation": null,
  "evidence": []
}

GET`/api/workflows/server-lifecycle/dry-run-contract`

request access

Workflows server lifecycle.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/server-lifecycle/dry-run-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`liveExecutionEnabled`	`boolean`	Required	Value of `liveExecutionEnabled` returned in the response body.
`workflows`	`array<JSON value>`	Required	Value of `workflows` returned in the response body.
`supportedHypervisors`	`array<JSON value>`	Required	Value of `supportedHypervisors` returned in the response body.
`supportedLinuxDistributions`	`array<JSON value>`	Required	Value of `supportedLinuxDistributions` returned in the response body.
`requiredInputs`	`array<JSON value>`	Required	Value of `requiredInputs` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/server-lifecycle/dry-run-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "workflows": [],
  "supportedHypervisors": [],
  "supportedLinuxDistributions": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET`/api/workflows/sql-server/deployment-contract`

request access

Workflows sql server.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/workflows/sql-server/deployment-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`liveExecutionEnabled`	`boolean`	Required	Value of `liveExecutionEnabled` returned in the response body.
`deploymentPlans`	`array<JSON value>`	Required	Value of `deploymentPlans` returned in the response body.
`topologies`	`array<JSON value>`	Required	Value of `topologies` returned in the response body.
`supportedHypervisors`	`array<JSON value>`	Required	Value of `supportedHypervisors` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/workflows/sql-server/deployment-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "deploymentPlans": [],
  "topologies": [],
  "supportedHypervisors": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

Last updated 2026-07-16 · Generated from the API route registrations.

Workflows API

GET/api/workflows/application-environment/deployment-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/workflows/application-environment/retirement-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/workflows/azure-landing-zone/validation-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/workflows/preflight/local/decision

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/workflows/server-lifecycle/dry-run-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/workflows/sql-server/deployment-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET`/api/workflows/application-environment/deployment-contract`

`200` response body

GET`/api/workflows/application-environment/retirement-contract`

`200` response body

GET`/api/workflows/azure-landing-zone/validation-contract`

`200` response body

GET`/api/workflows/preflight/local/decision`

`200` response body

GET`/api/workflows/server-lifecycle/dry-run-contract`

`200` response body

GET`/api/workflows/sql-server/deployment-contract`

`200` response body