Skip to content
CrowdStrike Developer Center

Workflows

The Workflows service collection provides operations for managing and executing CrowdStrike Falcon workflows. Search for workflow activities, triggers, definitions, and executions. Execute workflows on demand, import and export definitions, manage human input actions, and configure system definitions for multi-tenant deployments.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
v1.child-executions.query
query_child_executions		Search for child executions by providing a FQL filter and paging details.
WorkflowActivitiesCombined
search_activities		Search for activities by name.
WorkflowActivitiesContentCombined
search_activities_content		Search for activities by name.
WorkflowDefinitionsAction
workflow_definition_action		Enable or disable a workflow definition, or stop all executions for a definition.
WorkflowDefinitionsCombined
search_definitions		Search workflow definitions based on the provided filter.
WorkflowDefinitionsDelete
workflow_definitions_delete		Accepts a list of workflow definition IDs and deletes those definitions and all their associated versions.
WorkflowDefinitionsExport
export_definition		Exports a workflow definition for the given definition ID
WorkflowDefinitionsImport
import_definition		Imports a workflow definition based on the provided model
WorkflowDefinitionsUpdate
update_definition		Updates a workflow definition based on the provided model
WorkflowExecute
execute		Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowExecuteSingleNodeV1
execute_single_activity_node		Executes a single activity node, resulting in an execution where test_mode=true and single_node_execution=true, associated with a definition ID if provided
WorkflowExecutionResults
execution_results		Get execution result of a given execution
WorkflowExecutionsAction
execution_action		Allows a user to resume/retry a failed workflow execution, or cancel/stop a currently running workflow execution
WorkflowExecutionsCombined
search_executions		Search workflow executions based on the provided filter
WorkflowGetHumanInputV1
get_human_input		Gets one or more specific human inputs by their IDs.
WorkflowMockExecute
mock_execute		Executes a workflow definition with mocks
WorkflowSystemDefinitionsDeProvision
deprovision		Deprovisions a system definition that was previously provisioned on the target CID
WorkflowSystemDefinitionsPromote
promote		Promotes a version of a system definition for a customer.
WorkflowSystemDefinitionsProvision
provision		Provisions a system definition onto the target CID by using the template and provided parameters
WorkflowTriggersCombined
search_triggers		Search for triggers by namespaced identifier, i.e.
WorkflowUpdateHumanInputV1
update_human_input		Provides an input in response to a human input action.

v1.child-executions.query

Section titled “v1.child-executions.query”

Search for child executions by providing a FQL filter and paging details.

Method GET
Route /workflows/queries/child-executions/v1
Scope Workflow: READ
PEP 8 query_child_executions

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
sort query · string
Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.query_child_executions(filter="string",
                                         offset="string",
                                         limit=integer,
                                         sort="string")
print(response)
Responses
[
  "string"
]

WorkflowActivitiesCombined

Section titled “WorkflowActivitiesCombined”

Search for activities by name.

Method GET
Route /workflows/combined/activities/v1
Scope Workflow: READ
PEP 8 search_activities

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
sort query · string
Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
skip_artifact_resolution query · boolean
When true, skip Foundry artifact resolution and return the latest version of the activity, regardless of whether the associated Foundry app is installed
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.search_activities(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string",
                                    skip_artifact_resolution=boolean)
print(response)
Responses
[
  {
    "api_scope": "string",
    "app_id": "string",
    "cid": "string",
    "class": "string",
    "dependencies": [],
    "description": "string",
    "disruptive": false,
    "execution_route": "string",
    "has_permission": false,
    "id": "string",
    "input_fields": [],
    "input_schema": {},
    "legacy_namespace": "string",
    "mock_output": {},
    "name": "string",
    "namespace": "string",
    "output_fields": [],
    "output_schema": {},
    "semantic_version": "string",
    "updated": "string",
    "use_cases": [],
    "vendor": "string",
    "version": 0
  }
]

WorkflowActivitiesContentCombined

Section titled “WorkflowActivitiesContentCombined”

Search for activities by name.

Method GET
Route /workflows/combined/activity-content/v1
Scope Workflow: READ
PEP 8 search_activities_content

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
sort query · string
Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). If direction is omitted, defaults to descending.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.search_activities_content(filter="string",
                                            offset="string",
                                            limit=integer,
                                            sort="string")
print(response)
Responses
[
  {
    "api_scope": "string",
    "app_id": "string",
    "cid": "string",
    "class": "string",
    "dependencies": [],
    "description": "string",
    "disruptive": false,
    "execution_route": "string",
    "has_permission": false,
    "id": "string",
    "input_fields": [],
    "input_schema": {},
    "legacy_namespace": "string",
    "mock_output": {},
    "name": "string",
    "namespace": "string",
    "output_fields": [],
    "output_schema": {},
    "semantic_version": "string",
    "updated": "string",
    "use_cases": [],
    "vendor": "string",
    "version": 0
  }
]

WorkflowDefinitionsAction

Section titled “WorkflowDefinitionsAction”

Enable or disable a workflow definition, or stop all executions for a definition.

Method POST
Route /workflows/entities/definition-actions/v1
Scope Workflow: WRITE
PEP 8 workflow_definition_action

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
Execution IDs to perform an action
action_name query · string
Specify one of these actions: - enable: enable the workflow(s) specified in ids. - disable: disable the workflow(s) specified in ids. - cancel: cancel all in-flight executions for the workflow specified in ids
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.workflow_definition_action(action_name="string", ids=id_list)
print(response)
Responses
[
  "string"
]

WorkflowDefinitionsCombined

Section titled “WorkflowDefinitionsCombined”

Search workflow definitions based on the provided filter.

Method GET
Route /workflows/combined/definitions/v1
Scope Workflow: READ
PEP 8 search_definitions

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
sort query · string
Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.search_definitions(filter="string",
                                     offset="string",
                                     limit=integer,
                                     sort="string")
print(response)
Responses
[
  {
    "actions": {},
    "budget": {},
    "conditions": {},
    "description": "string",
    "disconnected_nodes": [],
    "enabled": false,
    "has_validation_errors": false,
    "id": "string",
    "labels": [],
    "last_modified_timestamp": "string",
    "loops": {},
    "multi_instance": false,
    "name": "string",
    "nodeRegistry": {},
    "output_fields": [],
    "parameters": {},
    "parent": {},
    "provision_on_install": false,
    "summary": "string",
    "trigger": {},
    "type": "string",
    "uniqNodeSeen": {},
    "use_cases": [],
    "vendors": [],
    "version": 0
  }
]

WorkflowDefinitionsDelete

Section titled “WorkflowDefinitionsDelete”

Accepts a list of workflow definition IDs and deletes those definitions and all their associated versions.

Method DELETE
Route /workflows/entities/definitions/v1
Scope Workflow: WRITE
PEP 8 workflow_definitions_delete

Parameters

Section titled “Parameters”
ids query · string or list of strings
IDs of the workflow definitions to delete
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.workflow_definitions_delete(ids=id_list)
print(response)
Responses
[
  "string"
]

WorkflowDefinitionsExport

Section titled “WorkflowDefinitionsExport”

Exports a workflow definition for the given definition ID

Method GET
Route /workflows/entities/definitions/export/v1
Scope Workflow: READ
PEP 8 export_definition

Parameters

Section titled “Parameters”
id query · string
ID of workflow definitions to return details for
sanitize query · boolean
whether or not to sanitize PII from workflow before it’s exported
include_mocks query · boolean
when enabled, includes referenced node-mocks inline in the exported YAML. Each mock’s output_data field is a JSON-encoded string rather than native YAML.
version query · integer
version of the definition to export (e.g. 0 for draft); omit for active/published
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.export_definition(id="string",
                                    include_mocks=boolean,
                                    version=integer,
                                    sanitize=boolean)
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

WorkflowDefinitionsImport

Section titled “WorkflowDefinitionsImport”

Imports a workflow definition based on the provided model

Method POST
Route /workflows/entities/definitions/import/v1
Scope Workflow: WRITE
PEP 8 import_definition

Parameters

Section titled “Parameters”
data_file body · file
A workflow definition in YAML format to import
name query · string
Workflow name to override
validate_only query · boolean
When enabled, prevents saving workflow after validating
include_activity_metadata query · boolean
When true, populates the definition model with Activity metadata which includes Activity Dependency and Vendor
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.import_definition(data_file="string",
                                    name="string",
                                    validate_only=boolean,
                                    include_activity_metadata=boolean)
print(response)
Responses
[
  {
    "activity_metadata": {},
    "description": "string",
    "disconnected_nodes": [],
    "id": "string",
    "model": {},
    "name": "string",
    "parameters": [],
    "validation_errors": []
  }
]

WorkflowDefinitionsUpdate

Section titled “WorkflowDefinitionsUpdate”

Updates a workflow definition based on the provided model

Method PUT
Route /workflows/entities/definitions/v1
Scope Workflow: WRITE
PEP 8 update_definition

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
definition body · object
Full workflow definition.
Definition body · object
Full workflow definition.
Definition body · object
Full workflow definition.
change_log body · string
Optional user provided description to outline the changes made as part of the update. Maximum of 500 characters.
enabled body · boolean
Specifies whether a new definition should be enabled when created, always set to false if it’s imported’
flight_control body · object
Child CID selection parameters for flight control aware workflows
id body · string
Used to identify documents across versions
validate_only query · boolean
When enabled, prevents saving workflow after validating
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.update_definition(validate_only=boolean,
                                    definition={},
                                    change_log="string",
                                    enabled=boolean,
                                    flight_control={},
                                    id="string")
print(response)
Responses
[
  "string"
]

WorkflowExecute

Section titled “WorkflowExecute”

Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)

Method POST
Route /workflows/entities/execute/v1
Scope Workflow: WRITE
PEP 8 execute

Parameters

Section titled “Parameters”
execution_cid query · string or list of strings
CID(s) to execute on. This can be a child if this is a flight control enabled definition. If unset the definition CID is used.
definition_id query · string or list of strings
Definition ID to execute, either a name or an ID can be specified.
name query · string
Workflow name to execute, either a name or an ID can be specified.
key query · string
Key used to help deduplicate executions, if unset a new UUID is used
depth query · integer
Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
source_event_url query · string
Used to record a URL to the source that led to triggering this workflow
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.execute(definition_id=id_list,
                          execution_cid=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string")
print(response)
Responses
[
  "string"
]

WorkflowExecuteSingleNodeV1

Section titled “WorkflowExecuteSingleNodeV1”

Executes a single activity node, resulting in an execution where test_mode=true and single_node_execution=true, associated with a definition ID if provided

Method POST
Route /workflows/entities/single-node-executions/v1
Scope Workflow: WRITE
PEP 8 execute_single_activity_node

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
definition body · object
definition to be executed with provided mock results and on-demand trigger data
mocks body · string
Mock activity data and trigger data for non-on-demand executions, keyed by node ID, may include trigger and/or activity nodes; mocks can also be defined by reference in the workflow definition itself; in case of a conflict, the mocks provided in the request body (this field) take precedence
execution_cid query · string or list of strings
CID(s) to execute on. This can be a child if this is a flight control enabled definition. If unset the definition CID is used.
definition_id query · string
Definition ID to execute, either a name or an ID, or the definition itself in the request body, can be specified.
name query · string
Workflow name to execute, either a name or an ID, or the definition itself in the request body, can be specified.
key query · string
Key used to help deduplicate executions, if unset a new UUID is used
depth query · integer
Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.execute_single_activity_node(execution_cid=id_list,
                                               definition_id="string",
                                               name="string",
                                               key="string",
                                               depth=integer,
                                               definition={})
print(response)
Responses
[
  "string"
]

WorkflowExecutionResults

Section titled “WorkflowExecutionResults”

Get execution result of a given execution

Method GET
Route /workflows/entities/execution-results/v1
Scope Workflow: READ
PEP 8 execution_results

Parameters

Section titled “Parameters”
ids query · string or list of strings
workflow execution id to return results for.
skip_fields query · string or list of strings
Fields to omit from the response; valid values:
Available values (3)
areactivitiesflows
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.execution_results(ids=id_list)
print(response)
Responses
[
  {
    "activities": [],
    "ancestor_executions": [],
    "contains_mocks": false,
    "definition_id": "string",
    "definition_name": "string",
    "definition_version": 0,
    "end_timestamp": "string",
    "execution_id": "string",
    "flows": [],
    "loops": [],
    "output_data": {},
    "retryable": false,
    "start_timestamp": "string",
    "status": "string",
    "summary": "string",
    "tested_entity": "string",
    "trigger": {}
  }
]

WorkflowExecutionsAction

Section titled “WorkflowExecutionsAction”

Allows a user to resume/retry a failed workflow execution, or cancel/stop a currently running workflow execution

Method POST
Route /workflows/entities/execution-actions/v1
Scope Workflow: WRITE
PEP 8 execution_action

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
Execution IDs to perform an action
action_name query · string
Specify one of these actions: - resume: resume/retry the workflow execution(s) specified in ids - cancel: cancel/stop the workflow execution specified in ids
Available values (2)
resumecancel
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
action_parameters body · list of dictionaries
List of actions to perform.
name body · string
For single action parameter actions. Specifies the action parameter name.
value body · string
For single action parameter actions. Specifies the action parameter value.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]


response = falcon.execution_action(action_name="string",
                                   action_parameters=action_parameters,
                                   ids=id_list,
                                   name="string",
                                   value="string")
print(response)
Responses
[
  "string"
]

WorkflowExecutionsCombined

Section titled “WorkflowExecutionsCombined”

Search workflow executions based on the provided filter

Method GET
Route /workflows/combined/executions/v1
Scope Workflow: READ
PEP 8 search_executions

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
sort query · string
Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.search_executions(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string")
print(response)
Responses
[
  {
    "activities": [],
    "ancestor_executions": [],
    "contains_mocks": false,
    "definition_id": "string",
    "definition_name": "string",
    "definition_version": 0,
    "end_timestamp": "string",
    "execution_id": "string",
    "flows": [],
    "loops": [],
    "output_data": {},
    "retryable": false,
    "start_timestamp": "string",
    "status": "string",
    "summary": "string",
    "tested_entity": "string",
    "trigger": {}
  }
]

WorkflowGetHumanInputV1

Section titled “WorkflowGetHumanInputV1”

Gets one or more specific human inputs by their IDs.

Method GET
Route /workflows/entities/human-inputs/v1
Scope Workflow: READ
PEP 8 get_human_input

Parameters

Section titled “Parameters”
ids query · string or list of strings
IDs of human inputs to read
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_human_input(ids=id_list)
print(response)
Responses
[
  {
    "allowed_inputs": [],
    "allowed_responders": [],
    "completed": false,
    "completed_at": "string",
    "created_at": "string",
    "id": "string",
    "input": "string",
    "note": "string",
    "responder": "string",
    "timeout_at": "string"
  }
]

WorkflowMockExecute

Section titled “WorkflowMockExecute”

Executes a workflow definition with mocks

Method POST
Route /workflows/entities/mock-executions/v1
Scope Workflow: WRITE
PEP 8 mock_execute

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
definition body · object
definition to be executed with provided mock results and on-demand trigger data
mocks body · string
Mock activity data and trigger data for non-on-demand executions, keyed by node ID, may include trigger and/or activity nodes; mocks can also be defined by reference in the workflow definition itself; in case of a conflict, the mocks provided in the request body (this field) take precedence
on_demand_trigger body · string
Trigger data for on-demand executions
execution_cid query · string or list of strings
CID(s) to execute on. This can be a child if this is a flight control enabled definition. If unset the definition CID is used.
definition_id query · string
Definition ID to execute, either a name or an ID, or the definition itself in the request body, can be specified.
name query · string
Workflow name to execute, either a name or an ID, or the definition itself in the request body, can be specified.
key query · string
Key used to help deduplicate executions, if unset a new UUID is used
depth query · integer
Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
source_event_url query · string
Used to record a URL to the source that led to triggering this workflow
validate_only query · boolean
When enabled, prevents execution after validating mocks from the request body against the mocked entity’s output schema. Mocks provided in the definition by reference are not validated in any case.
skip_validation query · boolean
When enabled, skips validating mocks from the request body against the mocked entity’s output schema. Mocks provided in the definition by reference are not validated in any case.
ignore_activity_mock_references query · boolean
When enabled, treats all activity mocks in the definition as disabled for this mock execution. Mocks provided in the request body are treated normally.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.mock_execute(definition_id="string",
                               execution_cid=id_list,
                               ignore_activity_mock_references=boolean,
                               name="string",
                               key="string",
                               depth=integer,
                               skip_validation=boolean,
                               source_event_url="string",
                               validate_only=boolean)
print(response)
Responses
[
  "string"
]

WorkflowSystemDefinitionsDeProvision

Section titled “WorkflowSystemDefinitionsDeProvision”

Deprovisions a system definition that was previously provisioned on the target CID

Method POST
Route /workflows/system-definitions/deprovision/v1
Scope Workflow: WRITE
PEP 8 deprovision

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
definition_id body · string
Customer scoped definition ID that is being deprovisioned. This is required when the template is defined as multi-instance
deprovision_all body · boolean
When enabled, the CustomerDefinitionID property is ignored and all template workflows are deprovisioned
template_id body · string
ID of the system definition template that is to be deprovisioned
template_name body · string
Name of the system definition template to deprovision
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.deprovision(definition_id="string",
                              deprovision_all=boolean,
                              template_id="string",
                              template_name="string")
print(response)
Responses
[
  "string"
]

WorkflowSystemDefinitionsPromote

Section titled “WorkflowSystemDefinitionsPromote”

Promotes a version of a system definition for a customer.

Method POST
Route /workflows/system-definitions/promote/v1
Scope Workflow: WRITE
PEP 8 promote

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
customer_definition_id body · string
Customer scoped definition ID that is being promoted. This is required when the template is defined as multi-instance
name body · string
Optional name to be set on the customer scope definition. Must be unique within a given CID.
parameters body · object
Runtime parameters to be interpolated to template model
template_id body · string
ID of the system definition template that was previously created
template_name body · string
Name of the system definition template to provision
template_version body · string
Version of system definition template that was previously created, if omitted the latest version will be used.
activities body · dictionary
conditions body · list of dictionaries
trigger body · dictionary
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}


conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]


trigger = {
    "fields": {},
    "node_id": "string"
}


response = falcon.promote(activities=activities,
                          conditions=conditions,
                          customer_definition_id="string",
                          name="string",
                          template_id="string",
                          template_name="string",
                          template_version="string",
                          trigger=trigger)
print(response)
Responses
[
  "string"
]

WorkflowSystemDefinitionsProvision

Section titled “WorkflowSystemDefinitionsProvision”

Provisions a system definition onto the target CID by using the template and provided parameters

Method POST
Route /workflows/system-definitions/provision/v1
Scope Workflow: WRITE
PEP 8 provision

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
name body · string
Optional name to be set on the customer scope definition. Must be unique within a given CID.
parameters body · object
Runtime parameters to be interpolated to template model
template_id body · string
ID of the system definition template that was previously created
template_name body · string
Name of the system definition template to provision
template_version body · string
Version of system definition template that was previously created, if omitted the latest version will be used.
activities body · dictionary
conditions body · list of dictionaries
trigger body · dictionary
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}


conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]


trigger = {
    "fields": {},
    "node_id": "string"
}


response = falcon.provision(activities=activities,
                            conditions=conditions,
                            name="string",
                            template_id="string",
                            template_name="string",
                            template_version="string",
                            trigger=trigger)
print(response)
Responses
[
  "string"
]

WorkflowTriggersCombined

Section titled “WorkflowTriggersCombined”

Search for triggers by namespaced identifier, i.e.

Method GET
Route /workflows/combined/triggers/v1
Scope Workflow: READ
PEP 8 search_triggers

Parameters

Section titled “Parameters”
filter query · string
FQL query specifying filter parameters.
offset query · string
Starting pagination offset of records to return.
limit query · integer
Maximum number of records to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.search_triggers(filter="string",
                                  offset="string",
                                  limit=integer)
print(response)
Responses
[
  {
    "api_scope": "string",
    "category": "string",
    "description": "string",
    "fields": [],
    "id": "string",
    "name": "string",
    "version": "string"
  }
]

WorkflowUpdateHumanInputV1

Section titled “WorkflowUpdateHumanInputV1”

Provides an input in response to a human input action.

Method PATCH
Route /workflows/entities/human-inputs/v1
Scope Workflow: WRITE
PEP 8 update_human_input

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
input body · string
input to provide to the user input activity
note body · string
note added to user input at the time an input is provided
id query · string
ID of human input to provide an input to
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Workflows


falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.update_human_input(id="string", input="string", note="string")
print(response)
Responses
[
  "string"
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use