Querying the Details of a Workflow Instance

Function

This API is used to query the details of a workflow instance.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances/{instance_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID, which is used to specify the project that a resource belongs to. You can query the resources of a project by project ID. You can obtain the project ID from the API or console. Obtaining the Project ID Constraints N/A Range N/A Default Value N/A
workspace_id	Yes	String	Definition Workspace ID. Range N/A
instance_id	Yes	String	Definition Workflow instance ID. Constraints N/A

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
show_topology	No	Boolean	Definition Whether to query the workflow topology information. true: query. false: not to query. Constraints N/A Range true false Default Value false

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. You can obtain it by calling the IAM API for obtaining a user token. The user token is the value of X-Subject-Token in the response header. Obtaining a User Token Constraints N/A Range N/A Default Value N/A
content-type	Yes	String	Definition Content type. application/json;charset=UTF-8: common API request type Constraints N/A Range application/json;charset=UTF-8 Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
id	String	Definition Workflow instance ID. Constraints N/A
name	String	Definition Workflow instance name. Constraints N/A
workflow	workflow object	Workflow object.
dataclass	dataclass object	Data class object.
playbook	playbook object	Playbook object.
trigger_type	String	Definition Trigger method. Range DEBUG: triggered by debugging TIMER: triggered periodically EVENT: triggered by an incident MANUAL: manually triggered
status	String	Definition Workflow instance status. Range RUNNING: being executed FAILED: execution failed FINISHED: execution finished RETRYING: being retried TERMINATING: being terminated TERMINATED: terminated
start_time	String	Definition Start time. Constraints N/A
end_time	String	Definition End time. Constraints N/A
retry_count	Integer	Definition Number of workflow instance retries. Constraints N/A
defense_id	String	Definition Defense layer ID. Constraints N/A
dataobject_id	String	Definition Data object ID. Constraints N/A
topology	WorkflowInstanceTopology object	Definition Workflow instance topology information. Constraints N/A

**Table 5** workflow
Parameter	Type	Description
id	String	Definition Workflow ID. Constraints N/A
name	String	Definition Workflow name in Chinese. Constraints N/A
name_en	String	Definition Workflow name in English. Constraints N/A
version	String	Definition Workflow version. Constraints N/A
version_id	String	Definition Workflow version ID. Constraints N/A

**Table 6** dataclass
Parameter	Type	Description
en_name	String	Definition Data class name in English. Constraints N/A
id	String	Definition Data class ID. Constraints N/A
name	String	Definition Data class name in Chinese. Constraints N/A

**Table 7** playbook
Parameter	Type	Description
en_name	String	Definition Playbook name in English. Constraints N/A
id	String	Definition Playbook ID. Constraints N/A
name	String	Definition Playbook name. Constraints N/A

**Table 8** WorkflowInstanceTopology
Parameter	Type	Description
audit_logs	Array of TopologyNodeInfo objects	Definition Topology node information. Constraints N/A

**Table 9** TopologyNodeInfo
Parameter	Type	Description
instance_type	String	Definition Node instance type of the workflow topology. Range TASK
action_id	String	Definition Node ID of the workflow topology. Range N/A
action_name	String	Definition Node name of the workflow topology. Range N/A
start_time	String	Definition Node start time of the workflow topology. Range N/A
end_time	String	Definition Node end time of the workflow topology. Range N/A
error_msg	String	Definition Node error information of the workflow topology. Range N/A
input	String	Definition Node input information of the workflow topology. Range N/A
output	String	Definition Node output information of the workflow topology. Range N/A
parent_instance_id	String	Definition Parent instance ID of the workflow topology. Range N/A
status	String	Definition Node status of the workflow topology. Range RUNNING: being executed FAILED: execution failed FINISHED: execution finished
succeed	Boolean	Definition Whether the node in the workflow topology is successful. Range true: successful. false: failed

Status code: 400

**Table 10** Response body parameters
Parameter	Type	Description
code	String	Definition Error code. Range N/A
message	String	Definition Error description. Range N/A

Example Requests

None

Example Responses

Status code: 200

Response to the request for querying the workflow instance details.

{
  "dataclass" : {
    "id" : "e410ae50-43fa-343e-807a-a2a9edb8018e",
    "name" : "Alert"
  },
  "dataobject_id" : "2462e8c3-e393-4af9-93b6-fe424c0b4e39",
  "defense_id" : "",
  "end_time" : "2025-07-18T15:11:04.577Z+0800",
  "id" : "8eed56de-7aaf-4732-baaf-46c1bb11dc8f",
  "name" : "ZFGJZDGB-20250718151103",
  "playbook" : {
    "id" : "3e966553-f53d-3d87-835e-7697e353876a",
    "name" : "Automatic closing of repeated alerts"
  },
  "retry_count" : 0,
  "start_time" : "2025-07-18T15:11:03.000Z+0800",
  "status" : "FINISHED",
  "trigger_type" : "EVENT",
  "workflow" : {
    "id" : "4a6fe02f-b4b4-3b5f-8a11-6f22229e18db",
    "name" : "Automatic closing of repeated alerts",
    "version" : "v1",
    "version_id" : "9f436a38-5c82-312b-aaba-b91a48e99086"
  }
}