API endpoints

The full public surface, grouped by resource. All paths are under /v1 and take a bearer token; org-scoped routes take your org slug in the path. For authentication, key scopes, conventions, pagination, and errors, see the REST API guide. Rows marked session only need a logged-in session; an API key can never perform them at any scope.

Resources

Resource	What it covers
Workflows	Create, version, disable, and delete workflows.
Runs	Trigger a run; list, read, cancel, and retry runs.
Schedules	Durable schedules: `cron`, `rate`, or `at`.
Webhooks	A workflow's inbound URL, auth mode, and secret.
Connections & deliveries	Provider connect flows and the inbound delivery log.
Watches	Subscriptions to workflow and run terminal outcomes.
Artifacts	List a run's artifacts and mint signed download URLs.
Secrets	Names and metadata; stage, rotate, delete (never values).
Environments	Named environments and non-secret variables.
Inference	BYO providers and the public managed-model price table.
API keys	List, mint, cap, and revoke keys.
Billing & usage	Usage windows, credit balance, seats, and the ledger.
Org, members, audit	Org lifecycle, members, invitations, security policy, the audit log, and exports.
You	Your profile, memberships, and account export.

Workflows

Method & path	What it does
`GET /orgs/:slug/workflows`	List the org's workflows (paginated).
`POST /orgs/:slug/workflows`	Create a workflow from a built program artifact (the CLI's `deploy`).
`POST /orgs/:slug/workflows/artifact-upload-url`	Mint a presigned upload URL for a program artifact before create/update.
`GET /workflows/:id`	Fetch one workflow, its manifest, and its current version.
`PATCH /workflows/:id`	Publish a new version (or rename the slug).
`DELETE /workflows/:id`	Delete a workflow (soft; runs and audit are retained).
`POST /workflows/:id/disable` · `/enable`	Pause every trigger, reversibly, then resume.

Runs

Method & path	What it does
`POST /orgs/:slug/workflows/:id/runs`	Trigger a run; optional `input` and `environment`. Returns 201.
`GET /orgs/:slug/workflows/:id/runs`	List a workflow's runs (filter `?status=`, paginated).
`GET /orgs/:slug/runs`	List every run across the org.
`GET /runs/:id`	Status, timing, token and cost totals, error.
`GET /runs/:id/input`	The trigger payload this run was called with.
`GET /runs/:id/events`	A snapshot of the run's stored event log.
`POST /runs/:id/cancel` · `/retry`	Stop a queued or in-flight run; re-run with the same input.

Schedules

Method & path	What it does
`POST /workflows/:id/schedules`	Create a durable schedule: exactly one of `cron`, `rate`, or `at`, with optional `timezone` and `input`.
`GET /workflows/:id/schedules`	List a workflow's durable schedules.
`DELETE /workflows/:id/schedules/:scheduleId`	Cancel a schedule so it stops firing.
`GET /orgs/:slug/schedules`	The org's cron triggers plus predicted next fire times (the agenda view).

Schedules created here are the same primitive a program provisions with workflows.schedule(). A crontrigger declared in the workflow's workflow.jsoncdescriptor needs nothing here; these endpoints are for schedules created at runtime or from your own tooling. When the workflow types its input, a schedule's static input is validated against the derived input schema at creation, so a bad payload is rejected then, not when it fires.

Webhooks

Method & path	What it does
`GET /orgs/:slug/workflows/:id/webhook`	The inbound URL and auth mode (the secret is never returned on read).
`POST /orgs/:slug/workflows/:id/webhook/rotate`	Rotate the secret; the new value is shown once (admin).

Connections & deliveries

Method & path	What it does
`POST /orgs/:slug/connections/:provider`	Start the connect flow: mints a single-use state and returns where to send the user.
`POST /orgs/:slug/connections/:provider/complete`	Finish it after the callback; the claim is verified against the provider, not trusted from the redirect.
`GET /orgs/:slug/connections/:provider`	The org's connections for that provider, with what each covers (GitHub: the repositories; Linear and Notion: the workspace; Jira: the site).
`DELETE /connections/:id`	Disconnect a provider connection.
`GET /orgs/:slug/deliveries`	The inbound delivery log: every event received, its outcome, and the runs it started or why it started none.
`POST /deliveries/:id/replay`	Replay one delivery through the router as a new row and decision (admin).

These back the provider triggers, so :provider is github, linear, jira, or notion. The triggers themselves live in a workflow's workflow.jsonc descriptor and are versioned with the workflow, so there is nothing to configure here per trigger. The delivery log and replay are shared by every provider. On a deployment where a provider is not configured, starting a connect flow fails with that reason and the GET answers { connections: [], configured: false } rather than pretending it could connect.

Watches

Method & path	What it does
`GET\|PUT\|DELETE /workflows/:id/watch`	Your subscription to a workflow's terminal outcomes.
`GET\|PUT\|DELETE /runs/:id/watch`	Your subscription to one run's terminal outcome.
`GET\|PATCH /me/notifications`	Your notification preferences and every watch you hold.
`DELETE /me/watches/:id`	Drop a single watch.

Artifacts

Method & path	What it does
`GET /orgs/:slug/runs/:id/artifacts`	List the artifacts a run produced.
`GET /artifacts/:id`	One artifact's metadata (name, content type, size, expiry).
`GET /artifacts/:id/download`	302 redirect to a short-lived signed URL.
`GET /artifacts/:id/download-url`	The signed URL as JSON (when you can't follow a redirect with a header).

See Artifacts for what a workflow writes and how the signed URLs work.

Secrets

Method & path	What it does
`GET /orgs/:slug/secrets`	List secret names and metadata. Values are never returned.
`POST /orgs/:slug/secrets` (session only)	Stage a secret value into the vault.
`GET /secrets/:id`	One secret's metadata.
`DELETE /secrets/:id` · `POST /secrets/:id/rotate` (session only)	Delete or rotate a secret.

Environments

Method & path	What it does
`POST /orgs/:slug/environments` · `GET`	Create a named environment; list the org's environments.
`GET\|PATCH\|DELETE /environments/:id`	Read, update, or delete one (delete cascades its secrets and variables).
`POST /orgs/:slug/env-variables` · `GET`	Set a non-secret variable on an environment or the org base; list them.
`GET\|PATCH\|DELETE /env-variables/:id`	Read, update, or delete one variable.

An environment scopes secrets and variables; a run picks one by name at trigger time, and an env-level value overrides the org base. See Secrets & environments.

Inference

Method & path	What it does
`GET /orgs/:slug/inference-providers`	List BYO providers (name, source, base URL). Keys are never returned.
`POST /orgs/:slug/inference-providers` (session only)	Register a provider and stage its key.
`DELETE /orgs/:slug/inference-providers/:name` (session only)	Remove a provider.
`PUT /orgs/:slug/inference-providers/:name/bedrock-role`	Wire a BYO Bedrock cross-account role (the second step after create).
`GET /inference/rates`	The public managed-model price table (no auth).

API keys

Method & path	What it does
`GET /orgs/:slug/api-keys`	List keys (prefix, last-4, scopes, spend cap; never the value).
`POST /orgs/:slug/api-keys` (session only)	Mint a key; the `bwk_` token is shown once.
`POST /orgs/:slug/inference-keys`	Mint an inference-only key with a default spend cap.
`PATCH /api-keys/:id` (session only)	Set or clear a monthly spend cap.
`DELETE /api-keys/:id`	Revoke a key.

Billing & usage

Method & path	What it does
`GET /orgs/:slug/usage`	Runs, compute, tokens, outcomes, and credit over a window.
`GET /orgs/:slug/workflows/:id/usage`	The same, scoped to one workflow.
`GET /orgs/:slug/billing/balance` · `/seats` · `/transactions`	Credit balance, seat counts, and the ledger.
`POST /orgs/:slug/billing/checkout` · `/portal`	Open a Stripe Checkout session or the customer portal (admin).
`GET\|PATCH /orgs/:slug/billing/email`	Read or set the billing email.

Org, members, audit

Method & path	What it does
`POST /orgs` · `GET /orgs/check-slug`	Create an org (you become owner); check slug availability.
`GET\|PATCH\|DELETE /orgs/:slug`	Read, rename, or delete the org (delete is owner-only).
`PATCH /orgs/:slug/security`	Require 2FA, allow-list email domains, set run retention (admin).
`GET\|PATCH\|DELETE /orgs/:slug/members/:userId`	List, re-role, or remove members.
`POST\|GET /orgs/:slug/invitations` · `DELETE .../:id`	Invite, list, or revoke (invite is session only).
`POST /invitations/accept`	Accept an invitation by token.
`GET /orgs/:slug/audit`	The audit log (admins see all; others see their own entries).
`POST /orgs/:slug/exports` · `GET .../exports/:id`	Request an org data export and read its status (admin).

You

Method & path	What it does
`GET /me`	Your profile and org memberships.
`PATCH /me` · `DELETE /me` (session only)	Update your display name; delete your account.
`POST /me/export`	Download your account data as JSON.