--- title: "List executions (MAP plans + WCP workflows)" method: GET path: "/api/v1/unified/executions" tags: ["Unified Executions"] --- # List executions (MAP plans + WCP workflows) `GET /api/v1/unified/executions` ## Request - Base URL: `https://orchestrator.getaxonflow.com` - URL: `https://orchestrator.getaxonflow.com/api/v1/unified/executions` - Auth: none declared. Required headers: `X-Tenant-ID`, `X-Org-ID` - TypeScript: (a function with typed inputs; its response is checked against the schema) Lists unified executions across both MAP plans and WCP workflows, scoped to the tenant/org identified by the `X-Tenant-ID` and `X-Org-ID` headers. The page size is capped by the license tier's execution-history limit (at most 100 per page); out-of-range `limit` or `offset` values are silently ignored and the defaults used. ## Query parameters - `limit` integer - `offset` integer - `execution_type` 'map_plan' | 'wcp_workflow' - `status` 'pending' | 'running' | 'completed' | 'failed' | 'cancelled' | 'aborted' | 'expired' ## Headers - `X-Tenant-ID` string, required - `X-Org-ID` string, required ## Response `200` Execution list - UnifiedExecutionListResponse - `executions` UnifiedExecutionStatus[] - `execution_id` string - `execution_type` 'map_plan' | 'wcp_workflow' - `name` string - `source` string - `status` 'pending' | 'running' | 'completed' | 'failed' | 'cancelled' | 'aborted' | 'expired' - `current_step_index` integer - `total_steps` integer - `progress_percent` number, double - `started_at` string, date-time - `completed_at` string, date-time - `duration` string - `estimated_cost_usd` number, double - `actual_cost_usd` number, double - `steps` UnifiedStepStatus[] - `step_id` string - `step_index` integer - `step_name` string - `step_type` 'llm_call' | 'tool_call' | 'connector_call' | 'human_task' | 'synthesis' | 'action' | 'gate' - `status` 'pending' | 'running' | 'completed' | 'failed' | 'skipped' | 'blocked' | 'approval' - `started_at` string, date-time - `ended_at` string, date-time - `duration` string - `decision` 'allow' | 'block' | 'require_approval' - `decision_reason` string - `policies_matched` string[] - `approval_status` 'pending' | 'approved' | 'rejected' | 'expired' - `approved_by` string - `approved_at` string, date-time - `rejected_by` string - `rejected_at` string, date-time - `model` string - `provider` string - `cost_usd` number, double - `tokens_in` integer - `tokens_out` integer - `input` unknown - `output` unknown - `result_summary` string - `error` string - `error` string - `tenant_id` string - `org_id` string - `user_id` string - `client_id` string - `metadata` object - `created_at` string, date-time - `updated_at` string, date-time - `total` integer - `limit` integer - `offset` integer - `has_more` boolean ## Other responses - `401`: `UNAUTHORIZED`: the request carried neither a tenant nor an org key (#3367). Before v10.0.0 this shape fell through to an unscoped `FROM execution_history WHERE 1=1` read of every organisation's executions and answered `200`. It is now refused with `Tenant or org identity required`, which is the same status the by-id half of this handler already returned for the same input. The handler and the execution repository refuse the shape independently, so a future caller reaching the repository by another route cannot reinstate the unscoped read. - `500`: The listing could not be served. Beyond an ordinary query failure, one arm of this status is a deliberate refusal of the org-wide read (#3367), reachable only on the org-wide branch that the trusted-hop `X-Axonflow-Tenancy-Scope` header selects: - **No BYPASSRLS admin pool.** A portal org-wide list on a deployment running `axonflow_app_role` (the default since v9.0.0) with no admin pool installed would be filtered to zero rows by the tenant-keyed RLS predicate on `execution_history`, and a `200` carrying a well-formed empty list is exactly the confident-empty page this refusal exists to remove. **The remedy is to set `AXONFLOW_DB_PLATFORM_ADMIN_URL`.** In practice this arm is defence in depth rather than a shape a running deployment reaches: the orchestrator carries a fatal boot guard on exactly that combination, so a deployment with the app-role posture enabled and this variable unset refuses to boot rather than serving the route at all. The refusal below the guard exists so that relaxing the guard could never silently restore the confident-empty page. - **A sentinel org key.** The org-wide branch requires a non-empty stamped `X-Org-ID`, but the handler does not check it against the unowned-org sentinel, so a trusted-hop request stamped with the sentinel value reaches the repository's org-key validation and its refusal surfaces as this 500. A real organisation id never takes this arm. The execution repository carries two further org-wide refusals (an org key with leading or trailing whitespace, and an org-wide read that also carries a tenant narrowing), but neither is reachable through this endpoint: the handler trims the org key once and clears the tenant narrowing before selecting the org-wide branch, so a padded `X-Org-ID` is served after trimming, not refused. The EMPTY half of the repository's org-key validation is also prevented by construction, because the org-wide branch requires a non-empty key; the SENTINEL half is not, which is why it appears in the cause list above. The unreachable refusals stay in the repository as defense in depth against a future caller that skips the handler's normalization; today this endpoint's handler is the repository listing's only caller. --- [API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)