---
title: "Update app catalog workflow"
method: PATCH
path: "/appCatalog/workflows/{idWorkflow}"
tags: ["App Catalog"]
---

# Update app catalog workflow

`PATCH /appCatalog/workflows/{idWorkflow}`

## Request

- Base URL: `https://api.toriihq.com/v1.0`
- URL: `https://api.toriihq.com/v1.0/appCatalog/workflows/{idWorkflow}`
- Auth: API key in header `Authorization`

Send a fetched workflow back with your edits; only `name` and `actions` change.<br/><br/>`actions` replaces the whole graph.<br/><br/>
<p><ul><li>Rate limit: 100 requests per minute</li></ul></p>

## Path parameters

- `idWorkflow` integer, required

## Request body

- UpdateAppCatalogWorkflow
  - `name` string: Display name.
  - `actions` Model136: The action graph: `nodes` maps each node id to its action, and `idRootNode` is the first node, or null when the graph is empty. Action types and their fields come from `GET /v1.0/workflows/actions`. Send `{ "idRootNode": null, "nodes": {} }` to clear the graph; null is not accepted.
    - `idRootNode` string: The id of the first node, or null when the graph is empty.
    - `nodes` Nodes: The actions, keyed by node id.
  - `triggerType` 'requestAccess' | 'temporaryAccessExpired' | 'requestNewApp': Cannot be changed. Accepted only when equal to the stored value, so a fetched workflow can be sent back as is.
  - `idApp` integer: Cannot be changed. Accepted only when equal to the stored value, so a fetched workflow can be sent back as is.
  - `isActive` boolean: New app request policies only. Accepted only when equal to the stored value; change it through the activation endpoint.
  - `id` integer: Read-only. Ignored on write.
  - `isDefault` boolean: Read-only. Ignored on write.
  - `isValid` boolean: Read-only. Ignored on write.
  - `isDeleted` boolean: Read-only. Ignored on write.
  - `createdBy` integer: Read-only. Ignored on write.
  - `creationTime` string, date: Read-only. Ignored on write.
  - `usedByPolicies` Model19[]: Read-only. Ignored on write.
    - `idAccessRequestPolicy` integer, required: The access request policy id: its `id` in the access request policies list.
    - `idApp` integer, required: The app the policy is for.
    - `name` string, required: The policy name. `Default access` for an unnamed policy, as in the access request policies list.
  - `executionsCount` integer: Read-only. Ignored on write.
  - `latestExecution` Model81: Read-only. Ignored on write.
    - `status` 'COMPLETED' | 'COMPLETED_WITH_ERRORS' | 'ERROR' | 'IN_PROGRESS' | 'STOPPED' | 'STOPPING', required: The run status.
    - `creationTime` string, date, required: When the run started.
    - `completionTime` string, date, required: When the run finished; null while it is still running.

## Response `200`

Successful

- Model139
  - `workflow` AppCatalogWorkflow, required
    - `id` integer, required: Read-only. Unique workflow identifier.
    - `name` string, required: Display name.
    - `triggerType` 'requestAccess' | 'temporaryAccessExpired' | 'requestNewApp', required: `requestAccess` = provisioning workflow and `temporaryAccessExpired` = deprovisioning workflow (both in the Access workflows tab); `requestNewApp` = new app request policy.
    - `idApp` integer: Access workflows only. The app this workflow provisions or deprovisions; null on the org default access workflows.
    - `isDefault` boolean: Read-only. Access workflows only. The org default access workflow for its trigger type. Cannot be deleted.
    - `actions` Model18, required: The action graph: `nodes` maps each node id to its action, and `idRootNode` is the first node, or null when the graph is empty. Action types and their fields come from `GET /v1.0/workflows/actions`. Send `{ "idRootNode": null, "nodes": {} }` to clear the graph; null is not accepted.
      - `idRootNode` string: The id of the first node, or null when the graph is empty.
      - `nodes` Nodes: The actions, keyed by node id.
    - `isValid` boolean, required: Read-only. Whether the actions graph passed validation.
    - `isActive` boolean: New app request policies only. Set through the activation endpoint. Access workflows have no activation state: they run whenever a policy that uses them fires.
    - `isDeleted` boolean, required: Read-only. Can only be true when fetched with includeDeleted.
    - `createdBy` integer, required: Read-only. The id of the user who created the workflow, null if no user did. Details in `resources.users`.
    - `creationTime` string, date, required: Read-only. When the workflow was created.
    - `usedByPolicies` Model19[]: Read-only. Access workflows only. The access request policies that use this workflow. On the org default workflows, only the policies of apps in the catalog. On other workflows, every policy that uses it, including policies whose app is no longer in the catalog.
      - `idAccessRequestPolicy` integer, required: The access request policy id: its `id` in the access request policies list.
      - `idApp` integer, required: The app the policy is for.
      - `name` string, required: The policy name. `Default access` for an unnamed policy, as in the access request policies list.
    - `executionsCount` integer, required: Read-only. How many times the workflow has run.
    - `latestExecution` LatestExecution, required: Read-only. The most recent run, or null if the workflow never ran.
      - `status` 'COMPLETED' | 'COMPLETED_WITH_ERRORS' | 'ERROR' | 'IN_PROGRESS' | 'STOPPED' | 'STOPPING', required: The run status.
      - `creationTime` string, date, required: When the run started.
      - `completionTime` string, date, required: When the run finished; null while it is still running.
  - `resources` Resources
    - `users` object
      - `number` Number
        - `id` integer, required
        - `firstName` string
        - `lastName` string
        - `email` string
        - `photoUrl` string
        - `isExternal` boolean
        - `lifecycleStatus` string
        - `isDeletedInIdentitySources` boolean
        - `userType` string
        - `isSupport` boolean
    - `apps` object
      - `number` Model22
        - `id` integer, required
        - `name` string
        - `imageUrl` string
        - `category` string

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/toriihq/apis/torii-api-documentation.md) - [All operations](https://skmtc.dev/toriihq/apis/torii-api-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/toriihq/apis/torii-api-documentation/revisions/15fd1512591b?raw)