Querying the Workflow Instance List

Function

This API is used to query workflow instance list.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID, which is used to specify the project that a resource belongs to. You can query the resources of a project by project ID. You can obtain the project ID from the API or console. Obtaining the Project ID Constraints N/A Range N/A Default Value N/A
workspace_id	Yes	String	Definition Workspace ID. Range N/A

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
offset	No	Integer	Definition Offset. Constraints 0 to 10,000 Range N/A Default Value 0
limit	No	Integer	Definition Data volume. Constraints 1 to 100 Range N/A Default Value 10
sort_key	No	String	Definition Sorting field. create_time: creation time update_time: update time. Constraints N/A Range create_time update_time Default Value create_time
sort_dir	No	String	Definition Sorting order. ASC: ascending order DESC: descending order Constraints N/A Range ASC: ascending order DESC: descending order Default Value DESC
from_date	No	String	Definition Start time. Constraints N/A Range N/A Default Value N/A
to_date	No	String	Definition End time. Constraints N/A Range N/A Default Value N/A
workflow_id	No	String	Definition Workflow ID. Constraints N/A Range N/A Default Value N/A
id	No	String	Definition Instance ID. Constraints N/A Range N/A Default Value N/A
name	No	String	Definition Instance name. Constraints N/A Range N/A Default Value N/A
dataobject_id	No	String	Definition ID of the object that triggers the workflow. Constraints N/A Range N/A Default Value N/A
dataclass_id	No	String	Definition Data class ID. Constraints N/A Range N/A Default Value N/A
playbook_id	No	String	Definition Playbook ID. Constraints N/A Range N/A Default Value N/A
defence_id	No	String	Definition Defense layer ID. Constraints N/A Range N/A Default Value N/A
status	No	String	Definition Workflow instance status. RUNNING: being executed FAILED: execution failed FINISHED: execution finished RETRYING: being retried TERMINATING: being terminated TERMINATED: terminated Constraints N/A Range RUNNING FAILED FINISHED RETRYING TERMINATING TERMINATED Default Value N/A
trigger_type	No	String	Definition Trigger method. DEBUG: triggered by debugging TIMER: triggered periodically EVENT: triggered by an incident MANUAL: manually triggered Constraints N/A Range DEBUG TIMER EVENT MANUAL Default Value N/A

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. You can obtain it by calling the IAM API for obtaining a user token. The user token is the value of X-Subject-Token in the response header. Obtaining a User Token Constraints N/A Range N/A Default Value N/A
content-type	Yes	String	Definition Content type. application/json;charset=UTF-8: common API request type Constraints N/A Range application/json;charset=UTF-8 Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
count	Integer	Definition Number of workflow instances. Constraints N/A
instances	Array of AopworkflowInstanceDetail objects	Definition Workflow instance details list. Constraints N/A

**Table 5** AopworkflowInstanceDetail
Parameter	Type	Description
id	String	Definition Workflow instance ID. Constraints N/A
name	String	Definition Workflow instance name. Constraints N/A
workflow	workflow object	Workflow object.
dataclass	dataclass object	Data class object.
playbook	playbook object	Playbook object.
trigger_type	String	Definition Trigger method. Range DEBUG: triggered by debugging TIMER: triggered periodically EVENT: triggered by an incident MANUAL: manually triggered
status	String	Definition Workflow instance status. Range RUNNING: being executed FAILED: execution failed FINISHED: execution finished RETRYING: being retried TERMINATING: being terminated TERMINATED: terminated
start_time	String	Definition Start time. Constraints N/A
end_time	String	Definition End time. Constraints N/A
retry_count	Integer	Definition Number of workflow instance retries. Constraints N/A
defense_id	String	Definition Defense layer ID. Constraints N/A
dataobject_id	String	Definition Data object ID. Constraints N/A
topology	WorkflowInstanceTopology object	Definition Workflow instance topology information. Constraints N/A

**Table 6** workflow
Parameter	Type	Description
id	String	Definition Workflow ID. Constraints N/A
name	String	Definition Workflow name in Chinese. Constraints N/A
name_en	String	Definition Workflow name in English. Constraints N/A
version	String	Definition Workflow version. Constraints N/A
version_id	String	Definition Workflow version ID. Constraints N/A

**Table 7** dataclass
Parameter	Type	Description
en_name	String	Definition Data class name in English. Constraints N/A
id	String	Definition Data class ID. Constraints N/A
name	String	Definition Data class name in Chinese. Constraints N/A

**Table 8** playbook
Parameter	Type	Description
en_name	String	Definition Playbook name in English. Constraints N/A
id	String	Definition Playbook ID. Constraints N/A
name	String	Definition Playbook name. Constraints N/A

**Table 9** WorkflowInstanceTopology
Parameter	Type	Description
audit_logs	Array of TopologyNodeInfo objects	Definition Topology node information. Constraints N/A

**Table 10** TopologyNodeInfo
Parameter	Type	Description
instance_type	String	Definition Node instance type of the workflow topology. Range TASK
action_id	String	Definition Node ID of the workflow topology. Range N/A
action_name	String	Definition Node name of the workflow topology. Range N/A
start_time	String	Definition Node start time of the workflow topology. Range N/A
end_time	String	Definition Node end time of the workflow topology. Range N/A
error_msg	String	Definition Node error information of the workflow topology. Range N/A
input	String	Definition Node input information of the workflow topology. Range N/A
output	String	Definition Node output information of the workflow topology. Range N/A
parent_instance_id	String	Definition Parent instance ID of the workflow topology. Range N/A
status	String	Definition Node status of the workflow topology. Range RUNNING: being executed FAILED: execution failed FINISHED: execution finished
succeed	Boolean	Definition Whether the node in the workflow topology is successful. Range true: successful. false: failed

Status code: 400

**Table 11** Response body parameters
Parameter	Type	Description
code	String	Definition Error code. Range N/A
message	String	Definition Error description. Range N/A

Example Requests

Query the instance list with name ZFGJZDGB-20250718151103.

https://{endpoint}/v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances?limit=10&offset=0&name=ZFGJZDGB-20250718151103

Example Responses

Status code: 200

Response to the request for querying the workflow instance list.

{
  "count" : 1,
  "instances" : [ {
    "dataclass" : {
      "id" : "e410ae50-43fa-343e-807a-a2a9edb8018e",
      "name" : "Alert"
    },
    "dataobject_id" : "2462e8c3-e393-4af9-93b6-fe424c0b4e39",
    "defense_id" : "",
    "end_time" : "2025-07-18T15:11:04.577Z+0800",
    "id" : "8eed56de-7aaf-4732-baaf-46c1bb11dc8f",
    "name" : "ZFGJZDGB-20250718151103",
    "playbook" : {
      "id" : "3e966553-f53d-3d87-835e-7697e353876a",
      "name" : "Automatic closing of repeated alerts"
    },
    "retry_count" : 0,
    "start_time" : "2025-07-18T15:11:03.000Z+0800",
    "status" : "FINISHED",
    "trigger_type" : "EVENT",
    "workflow" : {
      "id" : "4a6fe02f-b4b4-3b5f-8a11-6f22229e18db",
      "name" : "Automatic closing of repeated alerts",
      "version" : "v1",
      "version_id" : "9f436a38-5c82-312b-aaba-b91a48e99086"
    }
  } ]
}