GET) require capability workflow:read. Write operations (POST, PUT, DELETE) require workflow:write AND ownership — you can only modify workflows you created. Both capabilities are available to Pro+ tiers. Free tier has no external API access; Free users use the canvas via session.
Workflows are user-owned content. The capability layer admits the request; the ownership check inside the handler (
existing.createdBy === req.user.id) enforces that you can only edit your own workflows. There is no admin override on the standard endpoints.List workflows
isTemplate: true) created by other users that are visible platform-wide are also included.
Auth: capability workflow:read.
Response: an array of workflow summary objects.
The workflow’s URL slug and unique identifier.
The display name of the workflow.
The workflow’s description, if set.
Tag labels assigned to the workflow.
Whether this is a template (visible to all users).
Whether the workflow is hidden from your dashboard list.
Whether the workflow is archived.
Optional cover thumbnail
{ image, video? }.Legacy thumbnail (data URL or S3 URL).
User id of the workflow’s owner.
Estimated credit cost per run, calculated from generator nodes and your tier.
null if no generators.ID of the folder this workflow lives in.
null if at root level.ISO 8601 timestamp of the last update.
Get a single workflow
POST /api/workflows — it is round-trip safe and suitable for backup, forking, or templating.
Auth: capability workflow:read.
Create a workflow
name field to generate the workflow’s slug, appending -2, -3, etc. if the slug is already taken.
Auth: capability workflow:write. The created workflow is owned by your user (createdBy = your user id).
Request body (any subset of these — name is required):
Display name. The server converts this to a URL slug (lowercase, hyphens) and uses it as the permanent identifier. The slug cannot be changed after creation.
Short description of what the workflow does.
Tag labels.
Node definitions. Each includes
id, type, position, data.Connections between nodes. Each includes
id, source, target, sourceHandle, targetHandle.Saved canvas viewport
{ x, y, zoom }. Editor restores this position on open.When
true, schema is accessible without auth via GET /api/workflows/:slug/public-schema.When
true, the workflow appears in every user’s Templates section. Templates skip the maxWorkflows cap.Cover thumbnail
{ image, video? } (S3 URLs).Folder ID to place the workflow in. Omit or pass
null for root level.slug and timestamps.
Update a workflow
workflow:write AND ownership. Editing another user’s workflow returns 404.
Request body: any subset of the workflow JSON fields. The slug field is always read from the URL and cannot be changed via the request body.
Response: the full updated workflow JSON.
Move a workflow
workflow:write AND ownership.
The ID of the destination folder. Pass
null to move the workflow back to the root level.Delete a workflow
workflow:write AND ownership.
Workflow JSON schema
The full workflow object accepted and returned by these endpoints follows this shape:GET /api/workflows/:slug response is round-trip safe: you can GET a workflow, modify the JSON, and PUT it back without losing any fields.