GET Workflow Definitions

The GET /WorkflowClosed A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store./Definitions method is used to retrieve a list of workflow definitions. Query parameters enable filtering using defined criteria, control over pagination by specifying the page number and return limit, and customization of sorting based on specified fields and order. This method returns HTTP 200 OK on a success with high level information about the workflow definitions. Use the GET /Workflow/Definitions/{definitionid} method (see GET Workflow Definitions Definition ID) to return details including the workflow steps.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/workflows/definitions/read/

This method has two available versions. Version 1 has been deprecated. Version 2 should be used for all new integrations. For more information about versioning, see Versioning.

Version 2 of the GET /Workflow/Definitions method adds support for multi-key workflow definitions by returning an array of keys, rather than a single key, and includes additional metadataClosed Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. such as the workflow description.

Table 945: GET Workflow Definitions v2 Input Parameters

Name In Description
QueryString Query

A string containing a query to limit the results (e.g., field1 -eq value1 AND field2 -gt value2). The default is to return all records. Fields available for querying through the API for the most part match those that appear in the Keyfactor Command Management Portal search dropdowns for the same feature. For querying guidelines, refer to: Using the Workflow Definitions Search Feature. The query fields supported for this endpoint are:

  • DisplayName
  • Id
  • IsPublished (true or false)
  • WorkflowType (CertificateEnteredCollection, CertificateLeftCollection, Enrollment, or Revocation)
PageReturned Query An integer that specifies how many multiples of the returnLimit to skip and offset by before returning results, to enable paging. The default is 1.
ReturnLimit Query An integer that specifies how many results to return per page. The default is 50. Very large values can result in long processing time.
SortField Query

A string containing the property by which the results should be sorted. Fields available for sorting through the API include:

  • DisplayName

  • Enabled

  • Id

  • WorkflowType

Available sort fields are affected by the query provided in QueryString. The default sort field is DisplayName.
SortAscending Query An integer that sets the sort order on the returned results. A value of 0 sorts results in ascending order while a value of 1 sorts results in descending order. The default is ascending.

Table 946: GET Workflow Definitions v2 Response Data

Name

Description
Description A string indicating the description for the workflow definition.
Display Name A string indicating the display name defined for the workflow definition.
Draft Version An integer indicating the version number of the workflow definition. If this version number does not match the PublishedVersion, changes have been made to the workflow that have not yet been published.
Enabled A Boolean indicating whether the workflow definition is enabled (true) or not (false).
Id A string indicating the Keyfactor Command reference GUID of the workflow definition.
Keys

An array of objects containing the key information for the workflow definition. The meaning of each key depends on the workflow type. ClosedShow key details.
Published Version An integer indicating the currently published version number of the workflow definition.
Workflow Type

A string indicating the type of workflow definition. ClosedShow type details.

  • CertificateEnteredCollection

    Initiates a workflow instance when a certificate is identified that newly meets the query criteria of a certificate collection. For example, when a certificate discovered on an SSL scan becomes part of the Weak Keys collection, an email message can be generated notifying the PKI administrators that a new certificate with a weak key has been discovered.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your collections to identify certificates that newly meet the query criteria of each certificate collection. Certificates are added to a temporary table from which workflows of this type draw. Certificates are added for all collections regardless of whether they have active workflows. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

    If the task has run to create the temporary table of certificates that newly meet the query criteria of the specified certificate collection but a workflow has not yet run for the given collection—perhaps it is disabled or has not yet been created—there is a window of time (until the temporary table is cleared) during which if a workflow is created or enabled for the certificate collection, the user creating or enabling the workflow will receive a warning message indicating that the workflow will run multiple times and asking the user for confirmation to continue. The user must enter RUN followed by the number of workflow instances that will be initiated to continue.

    Figure 502: Warning on Save for Certificate Entered or Left Collection Workflow

  • CertificateLeftCollection

    Initiates a workflow instance when a certificate is identified that no longer meet the query criteria of the specified certificate collection. For example, when a certificate in the Web Server Certificates collection disappears, a REST request can be made to open a support ticket request to investigate the removal of a web server certificate.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your collections to identify certificates that no longer meet the query criteria of each certificate collection. Certificates are added to a temporary table from which workflows of this type draw. Certificates are added for all collections regardless of whether they have active workflows. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

    If the task has run to create the temporary table of certificates that no longer meet the query criteria of the specified certificate collection but a workflow has not yet run for the given collection—perhaps it is disabled or has not yet been created—there is a window of time (until the temporary table is cleared) during which if a workflow is created or enabled for the certificate collection, the user creating or enabling the workflow will receive a warning message indicating that the workflow will run multiple times and asking the user for confirmation to continue. The user must enter RUN followed by the number of workflow instances that will be initiated to continue.

  • CertificateEnteredStore

    Initiates a workflow instance when a certificate has been added to or has entered a certificate store for the specified certificate store type. For example, when a certificate appears in a trusted certificate store, a REST request can be made to check the support ticketing system for a change request, and the workflow can then generate an email message notifying the PKI administrators that a new certificate has appeared in a trusted store if a change request is not found.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your certificate store types to identify certificates that have been added to or have entered a certificate store for the specified certificate store type. Certificates are added to a temporary table from which workflows of this type draw. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs. Included in the workflow information are the certificate ID, certificate store ID, and certificate store container ID. If the certificate store is not associated with an application, the value will be -1.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

  • CertificateLeftStore

    Initiates a workflow instance when a certificate has been removed from or has left a certificate store for the specified certificate store type. For example, when a certificate on your F5 device disappears, a REST request can be made to open a support ticket request to investigate the removal of a certificate from the device.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your certificate store types to identify certificates that have been removed from or have left a certificate store for the specified certificate store type. Certificates are added to a temporary table from which workflows of this type draw. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs. Included in the workflow information are the certificate ID, certificate store ID, and certificate store container ID. If the certificate store is not associated with an application, the value will be -1.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

  • Enrollment (Including Renewals)

    The workflow is initiated by enrollment for a new or renewed certificate. Steps during the workflow can be used to do things such as require manager approval for the enrollment or manipulate the subject and/or SANs for the certificate request.

    Note:  An enrollment workflow is considered complete when the certificate reaches a state of Active (issued), Failed (denied approval in workflow or error at the CA level), Pending, or Waiting for External Validation. The workflow does not wait for external approvals before completing.

  • Expiration

    The workflow is initiated by an expiration alert. Steps during the workflow can be used to do things such as send an email notification regarding expiring certificates, run a PowerShell script to write notifications to the event log, or automate renewal of certificates.

  • Key Rotation

    The workflow is initiated by an SSH key rotation alert. Steps during the workflow can be used to do things such as send an email notification regarding SSH keys that are approaching their stale date or run a PowerShell script to write notifications to the event log.

  • Revocation

    The workflow is initiated by revoking a certificate. Steps during the workflow can be configured to do things such as modify the revocation comment entered when the certificate is revoked, append an additional comment, and store the resulting extended comment in a metadata field.

  • Revocation Monitoring

    The workflow is initiated by a revocation monitoring alert. Steps during the workflow can be used to do things such as send an email notification regarding CRLs that are expiring or OCSP endpoints that are unreachable or run a PowerShell script to write notifications to the event log.

Version 1 of the GET /Workflow/Definitions method returns workflow definitions using the legacy single-key model, where each workflow definition is associated with a single key. This version does not support workflows associated with multiple keys and has been deprecated. Version 2 reflects the current workflow key model and should be used instead.

Table 947: GET Workflow Definitions v1 Input Parameters

Name In Description
QueryString Query

A string containing a query to limit the results (e.g., field1 -eq value1 AND field2 -gt value2). The default is to return all records. Fields available for querying through the API for the most part match those that appear in the Keyfactor Command Management Portal search dropdowns for the same feature. For querying guidelines, refer to: Using the Workflow Definitions Search Feature. The query fields supported for this endpoint are:

  • DisplayName
  • Id
  • IsPublished (true or false)
  • WorkflowType (CertificateEnteredCollection, CertificateLeftCollection, Enrollment, or Revocation)
PageReturned Query An integer that specifies how many multiples of the returnLimit to skip and offset by before returning results, to enable paging. The default is 1.
ReturnLimit Query An integer that specifies how many results to return per page. The default is 50. Very large values can result in long processing time.
SortField Query

A string containing the property by which the results should be sorted. Fields available for sorting through the API include:

  • DisplayName

  • Enabled

  • Id

  • WorkflowType

Available sort fields are affected by the query provided in QueryString. The default sort field is DisplayName.
SortAscending Query An integer that sets the sort order on the returned results. A value of 0 sorts results in ascending order while a value of 1 sorts results in descending order. The default is ascending.

Table 948: GET Workflow Definitions v1 Response Data

Name

Description
Id A string indicating the Keyfactor Command reference GUID of the workflow definition.
Display Name

A string indicating the display name defined for the workflow definition.

Note:  If multiple keys are associated with the workflow definition, the DisplayName value reflects the first key, determined by alphanumeric ordering of the definition’s key values.
Key

A string indicating the reference key and optional subkey for the workflow definition given as the key ID and optional subkey ID. The type of information contained in this field will vary depending on the WorkflowType:

  • Certificate Entered Collection: The key is the certificate collection Id.

  • Certificate Left Collection: The key is the certificate collection Id.

  • Certificate Entered Store: The key is the certificate store type StoreType.

  • Certificate Left Store: The key is the certificate store type StoreType.

  • Enrollment: The key is the certificate template Id and the optional subkey is the enrollment pattern Id.

  • Expiration: The key is the Id for the expiration alert.

  • Key Rotation: The key is the Id for the key rotation alert.

  • Revocation: The key is the certificate template Id.

  • Revocation Monitoring: The key is the Id for the revocation monitoring endpoint.
Key Display Name A string indicating the human readable name for the key and optional subkey. If a friendly name has been defined for the key entity, that value is used in this field. Otherwise, the display name is used.
Workflow Type

A string indicating the type of workflow definition. The currently supported types are:

  • CertificateEnteredCollection

    Initiates a workflow instance when a certificate is identified that newly meets the query criteria of a certificate collection. For example, when a certificate discovered on an SSL scan becomes part of the Weak Keys collection, an email message can be generated notifying the PKI administrators that a new certificate with a weak key has been discovered.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your collections to identify certificates that newly meet the query criteria of each certificate collection. Certificates are added to a temporary table from which workflows of this type draw. Certificates are added for all collections regardless of whether they have active workflows. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

    If the task has run to create the temporary table of certificates that newly meet the query criteria of the specified certificate collection but a workflow has not yet run for the given collection—perhaps it is disabled or has not yet been created—there is a window of time (until the temporary table is cleared) during which if a workflow is created or enabled for the certificate collection, the user creating or enabling the workflow will receive a warning message indicating that the workflow will run multiple times and asking the user for confirmation to continue. The user must enter RUN followed by the number of workflow instances that will be initiated to continue.

    Figure 503: Warning on Save for Certificate Entered or Left Collection Workflow

  • CertificateLeftCollection

    Initiates a workflow instance when a certificate is identified that no longer meet the query criteria of the specified certificate collection. For example, when a certificate in the Web Server Certificates collection disappears, a REST request can be made to open a support ticket request to investigate the removal of a web server certificate.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your collections to identify certificates that no longer meet the query criteria of each certificate collection. Certificates are added to a temporary table from which workflows of this type draw. Certificates are added for all collections regardless of whether they have active workflows. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

    If the task has run to create the temporary table of certificates that no longer meet the query criteria of the specified certificate collection but a workflow has not yet run for the given collection—perhaps it is disabled or has not yet been created—there is a window of time (until the temporary table is cleared) during which if a workflow is created or enabled for the certificate collection, the user creating or enabling the workflow will receive a warning message indicating that the workflow will run multiple times and asking the user for confirmation to continue. The user must enter RUN followed by the number of workflow instances that will be initiated to continue.

  • CertificateEnteredStore

    Initiates a workflow instance when a certificate has been added to or has entered a certificate store for the specified certificate store type. For example, when a certificate appears in a trusted certificate store, a REST request can be made to check the support ticketing system for a change request, and the workflow can then generate an email message notifying the PKI administrators that a new certificate has appeared in a trusted store if a change request is not found.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your certificate store types to identify certificates that have been added to or have entered a certificate store for the specified certificate store type. Certificates are added to a temporary table from which workflows of this type draw. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs. Included in the workflow information are the certificate ID, certificate store ID, and certificate store container ID. If the certificate store is not associated with an application, the value will be -1.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

  • CertificateLeftStore

    Initiates a workflow instance when a certificate has been removed from or has left a certificate store for the specified certificate store type. For example, when a certificate on your F5 device disappears, a REST request can be made to open a support ticket request to investigate the removal of a certificate from the device.

    The workflow is initiated by two automated tasks that Keyfactor Command runs periodically. The first runs against your certificate store types to identify certificates that have been removed from or have left a certificate store for the specified certificate store type. Certificates are added to a temporary table from which workflows of this type draw. The second reads the temporary table and generates workflow instances for any active workflows of this type. The temporary table is cleared each time the first task runs. Included in the workflow information are the certificate ID, certificate store ID, and certificate store container ID. If the certificate store is not associated with an application, the value will be -1.

    Each of these tasks runs every 10 minutes by default and the schedules for them are not end-user configurable.

  • Enrollment (Including Renewals)

    The workflow is initiated by enrollment for a new or renewed certificate. Steps during the workflow can be used to do things such as require manager approval for the enrollment or manipulate the subject and/or SANs for the certificate request.

    Note:  An enrollment workflow is considered complete when the certificate reaches a state of Active (issued), Failed (denied approval in workflow or error at the CA level), Pending, or Waiting for External Validation. The workflow does not wait for external approvals before completing.

  • Expiration

    The workflow is initiated by an expiration alert. Steps during the workflow can be used to do things such as send an email notification regarding expiring certificates, run a PowerShell script to write notifications to the event log, or automate renewal of certificates.

  • Key Rotation

    The workflow is initiated by an SSH key rotation alert. Steps during the workflow can be used to do things such as send an email notification regarding SSH keys that are approaching their stale date or run a PowerShell script to write notifications to the event log.

  • Revocation

    The workflow is initiated by revoking a certificate. Steps during the workflow can be configured to do things such as modify the revocation comment entered when the certificate is revoked, append an additional comment, and store the resulting extended comment in a metadata field.

  • Revocation Monitoring

    The workflow is initiated by a revocation monitoring alert. Steps during the workflow can be used to do things such as send an email notification regarding CRLs that are expiring or OCSP endpoints that are unreachable or run a PowerShell script to write notifications to the event log.
Draft Version An integer indicating the version number of the workflow definition. If this version number does not match the PublishedVersion, changes have been made to the workflow definition that have not yet been published.
Published Version An integer indicating the currently published version number of the workflow definition.
Tip:  See the Keyfactor API Reference and Utility which provides a utility through which the Keyfactor APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. endpoints can be called and results returned. It is intended to be used primarily for validation, testing and workflow development. It also serves secondarily as documentation for the API. The link to the Keyfactor API Reference and Utility is in the dropdown from the help icon () at the bottom of the Management Portal side menu.