---
title: "Create app catalog workflow"
method: POST
path: "/appCatalog/workflows"
tags: ["App Catalog"]
---

# Create app catalog workflow

`POST /appCatalog/workflows`

## Request

- Base URL: `https://api.toriihq.com/v1.0`
- URL: `https://api.toriihq.com/v1.0/appCatalog/workflows`
- Auth: API key in header `Authorization`

`idApp` comes from the apps list. Access workflows start from the catalog template.<br/><br/>Build the graph in steps: create, read the new workflow’s placeholders (`GET /workflows/{idWorkflow}/config`), then update `actions`.<br/><br/>A new access workflow runs only once an access request policy uses it, and that link is set in the App Catalog in Torii, not through the API.<br/><br/>
<p><ul><li>Rate limit: 50 requests per minute</li></ul></p>

## Request body

- CreateAppCatalogWorkflow
  - `triggerType` 'requestAccess' | 'temporaryAccessExpired' | 'requestNewApp', required: `requestAccess` = provisioning workflow and `temporaryAccessExpired` = deprovisioning workflow (both in the Access workflows tab); `requestNewApp` = new app request policy.
  - `idApp` integer: Required for `requestAccess` and `temporaryAccessExpired`: the app the workflow provisions or deprovisions. Not allowed for `requestNewApp`.
  - `name` string: Display name. Defaults to `<app name> provisioning workflow` or `<app name> deprovisioning workflow`, with ` (N)` added when the app already has N workflows of that kind; `New app request policy (N)` for a new app request policy.
  - `actions` Model78: Replaces the starting graph: the catalog template for access workflows, the empty graph for new app request policies. The graph is validated, and the response's isValid shows the result. The action graph: `nodes` maps each node id to its action, and `idRootNode` is the first node, or null when the graph is empty. Action types and their fields come from `GET /v1.0/workflows/actions`. Send `{ "idRootNode": null, "nodes": {} }` to clear the graph; null is not accepted.
    - `idRootNode` string: The id of the first node, or null when the graph is empty.
    - `nodes` Nodes: The actions, keyed by node id.
  - `id` integer: Read-only. Ignored on write.
  - `isDefault` boolean: Read-only. Ignored on write.
  - `isValid` boolean: Read-only. Ignored on write.
  - `isDeleted` boolean: Read-only. Ignored on write.
  - `createdBy` integer: Read-only. Ignored on write.
  - `creationTime` string, date: Read-only. Ignored on write.
  - `usedByPolicies` Model19[]: Read-only. Ignored on write.
    - `idAccessRequestPolicy` integer, required: The access request policy id: its `id` in the access request policies list.
    - `idApp` integer, required: The app the policy is for.
    - `name` string, required: The policy name. `Default access` for an unnamed policy, as in the access request policies list.
  - `executionsCount` integer: Read-only. Ignored on write.
  - `latestExecution` Model81: Read-only. Ignored on write.
    - `status` 'COMPLETED' | 'COMPLETED_WITH_ERRORS' | 'ERROR' | 'IN_PROGRESS' | 'STOPPED' | 'STOPPING', required: The run status.
    - `creationTime` string, date, required: When the run started.
    - `completionTime` string, date, required: When the run finished; null while it is still running.

## Response `201`

Created

- Model82
  - `workflow` AppCatalogWorkflow, required
    - `id` integer, required: Read-only. Unique workflow identifier.
    - `name` string, required: Display name.
    - `triggerType` 'requestAccess' | 'temporaryAccessExpired' | 'requestNewApp', required: `requestAccess` = provisioning workflow and `temporaryAccessExpired` = deprovisioning workflow (both in the Access workflows tab); `requestNewApp` = new app request policy.
    - `idApp` integer: Access workflows only. The app this workflow provisions or deprovisions; null on the org default access workflows.
    - `isDefault` boolean: Read-only. Access workflows only. The org default access workflow for its trigger type. Cannot be deleted.
    - `actions` Model18, required: The action graph: `nodes` maps each node id to its action, and `idRootNode` is the first node, or null when the graph is empty. Action types and their fields come from `GET /v1.0/workflows/actions`. Send `{ "idRootNode": null, "nodes": {} }` to clear the graph; null is not accepted.
      - `idRootNode` string: The id of the first node, or null when the graph is empty.
      - `nodes` Nodes: The actions, keyed by node id.
    - `isValid` boolean, required: Read-only. Whether the actions graph passed validation.
    - `isActive` boolean: New app request policies only. Set through the activation endpoint. Access workflows have no activation state: they run whenever a policy that uses them fires.
    - `isDeleted` boolean, required: Read-only. Can only be true when fetched with includeDeleted.
    - `createdBy` integer, required: Read-only. The id of the user who created the workflow, null if no user did. Details in `resources.users`.
    - `creationTime` string, date, required: Read-only. When the workflow was created.
    - `usedByPolicies` Model19[]: Read-only. Access workflows only. The access request policies that use this workflow. On the org default workflows, only the policies of apps in the catalog. On other workflows, every policy that uses it, including policies whose app is no longer in the catalog.
      - `idAccessRequestPolicy` integer, required: The access request policy id: its `id` in the access request policies list.
      - `idApp` integer, required: The app the policy is for.
      - `name` string, required: The policy name. `Default access` for an unnamed policy, as in the access request policies list.
    - `executionsCount` integer, required: Read-only. How many times the workflow has run.
    - `latestExecution` LatestExecution, required: Read-only. The most recent run, or null if the workflow never ran.
      - `status` 'COMPLETED' | 'COMPLETED_WITH_ERRORS' | 'ERROR' | 'IN_PROGRESS' | 'STOPPED' | 'STOPPING', required: The run status.
      - `creationTime` string, date, required: When the run started.
      - `completionTime` string, date, required: When the run finished; null while it is still running.
  - `resources` Resources
    - `users` object
      - `number` Number
        - `id` integer, required
        - `firstName` string
        - `lastName` string
        - `email` string
        - `photoUrl` string
        - `isExternal` boolean
        - `lifecycleStatus` string
        - `isDeletedInIdentitySources` boolean
        - `userType` string
        - `isSupport` boolean
    - `apps` object
      - `number` Model22
        - `id` integer, required
        - `name` string
        - `imageUrl` string
        - `category` string

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/toriihq/apis/torii-api-documentation.md) - [All operations](https://skmtc.dev/toriihq/apis/torii-api-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/toriihq/apis/torii-api-documentation/revisions/15fd1512591b?raw)