Reference
Every app, API call, setting, Helm value, metric and error code, in one list.
Apps 133
- ErrorStart a workflow when another workflow fails.
errortrigger - FormStart a workflow when someone sends a form.
form - ManualRun a workflow by hand, with the Run button or the API.
manual - MCP ToolLet an AI app call a workflow as a tool.
mcptool - Run FinishedStart a workflow when another workflow’s run finishes.
runfinishedtrigger - ScheduleStart a workflow at set times.
schedule - WebhookStart a workflow when its own web address is called.
webhook - When Called by Another WorkflowStart a workflow when another workflow runs it as a Sub-flow.
callable - ApprovalPause the run until someone approves or rejects.
approval - BranchSend the run down different paths by condition.
branch - CodeRun your own JavaScript to reshape data.
code - Delay / WaitPause the run for a time, until a time, or until a call resumes it.
delay - FilterStop the run unless its conditions are met.
filter - LoopRun steps once for each item in a list.
loop - No OpDo nothing: a placeholder or a note.
no-op - Stop / ErrorEnd the whole run here, cleanly or with an error.
stop-error - Sub-flowRun another workflow as a step and use its output.
subflow - SwitchSend the run to one of several cases by one value.
switch - TagsTag the current run, to filter runs by.
tags - AirtableCreate, update, upsert, find and delete records in Airtable, upload files and comment on records, and read or change bases, tables and fields.
airtable, airtabletrigger - Amazon S3Upload, download, copy, move and delete files in Amazon S3 or an S3-compatible store (MinIO, Wasabi, Cloudflare R2, Hetzner, IONOS), list and create buckets and folders, and make temporary download and upload links.
amazons3, amazons3trigger - AsanaCreate, find and update tasks and subtasks in Asana, comment on them, move them between projects and sections, tag them, attach files, and manage projects, sections, tags and users.
asana, asanatrigger - ClickUpCreate, find and update ClickUp tasks, lists and folders, comment, track time, and manage checklists, tags, goals and dependencies.
clickup, clickuptrigger - Compare DatasetsCompare two lists by a key, row by row.
compare - CompressionZip and unzip files, or gzip and gunzip data.
compression - CryptoHash, sign with HMAC, encode, and make random values.
crypto - CSVRead CSV into rows, or write CSV from data.
csv - Date & TimeFormat dates, add time, and find the time between two dates.
date-helper - DropboxUpload, download, copy, move and delete files and folders in Dropbox, list and search them, and share them by link.
dropbox, dropboxtrigger - Edit FieldsSet, build or reshape fields for later steps.
data-mapper - Files HelperCreate, read, inspect and convert files.
file-helper - FTP/SFTPMove files to and from a server over SFTP, FTPS or FTP.
sftp, sftptrigger - GitHubOpen and update issues and pull requests, review and merge, commit files, create branches and releases, run Actions workflows, and read repositories, organizations and users on GitHub.
github, githubtrigger - GitLabOpen and update issues and merge requests, merge, commit files, create branches and releases, run CI/CD pipelines, and read projects on GitLab.com or your own GitLab.
gitlab, gitlabtrigger - Google AnalyticsRun Google Analytics 4 reports and realtime reports, and look up accounts, properties, data streams and the dimensions and metrics a property offers.
googleanalytics - Google BigQueryRun SQL in Google BigQuery with query parameters, stream rows into tables, read table rows and schemas, and list projects, datasets, tables and jobs.
googlebigquery - Google CalendarCreate, update and find events in Google Calendar.
googlecalendar, googlecalendartrigger - Google DocsCreate, read and edit documents in Google Docs.
googledocs - Google DriveUpload, download, move, share and search files in Google Drive.
googledrive, googledrivetrigger - Google FormsRead Google Forms responses with their answers by question, create forms, add or remove questions, and open or close a form to responses.
googleforms, googleformstrigger - Google SheetsRead, add and update rows in Google Sheets.
googlesheets, googlesheetstrigger - Google SlidesCreate presentations, read slides and their text, fill in placeholder text and images, add or delete slides, and get slide thumbnails in Google Slides.
googleslides - Google TasksCreate, find, update, move, complete and delete tasks in Google Tasks, and manage task lists.
googletasks - HTMLPick content out of HTML by CSS selector, strip tags, or list links.
html - HubSpotCreate, find and update contacts, companies, deals and tickets in HubSpot, log notes, tasks, calls, emails and meetings, link records, and manage list members.
hubspot, hubspottrigger - iCalendarBuild or read iCalendar (.ics) events.
icalendar - ImageResize, convert, crop or inspect an image.
image - Item HelperSort, limit, deduplicate, group and reshape lists of items.
items - Jira SoftwareCreate, find, update and move Jira issues from status to status, and work with their comments, attachments, worklogs and links, and with users.
jira, jiratrigger - JotformRead, add, edit and delete Jotform submissions, and look up forms, their questions and the account.
jotform, jotformtrigger - JSONRead, set, merge and pick fields in JSON.
json - JWTSign, verify and decode JSON Web Tokens.
jwt - LinearCreate, find, update and archive Linear issues, comment on them, link and relate them, manage projects and project updates, and look up teams, people, statuses, labels and cycles.
linear - Linear TriggerStart a workflow when an issue, comment, project, cycle or another Linear record is created, updated or removed.
lineartrigger - MarkdownConvert between Markdown and HTML.
markdown - Math HelperAdd, divide, round and total numbers.
math - MergeCombine two lists: append, join by key, or pair by position.
merge - Microsoft Excel 365Read, add and update rows in Excel workbooks in OneDrive or SharePoint, by sheet or by table, and create and organize workbooks and sheets.
microsoftexcel - Microsoft OneDriveUpload, download, copy, move, share and organize files and folders in OneDrive.
microsoftonedrive, onedrivetrigger - Microsoft SharePointCreate, find, update and delete SharePoint list items, read lists and sites, and upload, download and organize files in document libraries.
microsoftsharepoint, sharepointtrigger - Microsoft To DoCreate, update and find tasks and task lists in Microsoft To Do, with their steps, links back to their source and file attachments.
microsofttodo, microsofttodotrigger - monday.comCreate, find and update items and subitems on monday.com boards, post updates, and manage boards, groups, columns and their labels.
monday, mondaytrigger - MongoDBFind, insert, update, delete and aggregate documents in MongoDB.
mongodb - MySQLRun SQL against a MySQL or MariaDB database.
mysql - NinoxCreate, find, update and delete records in Ninox databases, attach and download files, and run Ninox scripts.
ninox, ninoxtrigger - NotionCreate, find and update pages in Notion databases, write and read page content as Markdown or blocks, comment, and look up databases, data sources and users.
notion, notiontrigger - OdooCreate, find, update and delete contacts, CRM opportunities, activities and records of any Odoo model, and log notes on records.
odoo, odootrigger - PDFRead the text of a PDF, or count its pages.
pdf - PersonioCreate and update employees, record absences and working time, manage projects, and upload or download employee documents in Personio.
personio, personiotrigger - PipedriveCreate, find and update deals, people, organizations, leads, activities, notes, products and files in Pipedrive.
pipedrive, pipedrivetrigger - PostgreSQLRead and change rows in a PostgreSQL database with SQL.
postgres - QR CodeMake a QR code image from text.
qrcode - QueuePush items into a queue and pull them out in order.
queue - RedisRun a Redis command.
redis - RSS FeedRead the items of an RSS or Atom feed.
rss - SalesforceCreate, find, update and delete Salesforce accounts, contacts, leads, opportunities, cases, tasks and records of any object, query with SOQL, search text, upload files and start flows.
salesforce, salesforcetrigger - SeaTableWork with a SeaTable base, or query it with SQL.
seatable, seatabletrigger - SpreadsheetRead or write an .xlsx spreadsheet.
spreadsheet - StorageKeep values between runs, each under its own key.
store - SupabaseCreate, find, update and delete rows in a Supabase project's tables, call its database functions, and store files in Supabase Storage.
supabase, supabasetrigger - TallyRead and delete Tally submissions, create, change and delete forms, and look up questions and workspaces.
tally, tallytrigger - Text HelperJoin, replace, split, trim and change the case of text.
text - TodoistCreate, update, complete and move tasks in Todoist, read completed tasks, and manage projects, sections, comments, labels and reminders.
todoist, todoisttrigger - TOTP / 2FAMake or check two-factor one-time codes (TOTP).
totp - TrelloCreate, move and update Trello cards, comment on them, manage checklists, labels, attachments and custom fields, and work with lists, boards and board members.
trello, trellotrigger - TypeformRead and delete Typeform responses, create and change forms, and manage workspaces and images.
typeform, typeformtrigger - WordPressCreate, find, update and delete posts, pages, users, media, categories and tags on a WordPress site.
wordpress - XMLRead XML into data, or build XML from data.
xml - YouTubeUpload, find, update and rate YouTube videos, manage playlists and their videos, update your channel, and read, post or reply to comments.
youtube - Zoho CRMCreate, find, update and delete Zoho CRM leads, contacts, accounts, deals, quotes, orders, invoices, products, vendors and records of any module, add notes, and query with COQL.
zohocrm - GraphQLSend queries and mutations to any GraphQL API.
graphql - HTTP RequestCall any web address or API.
http - AnthropicAsk Claude for text or JSON, with images, PDFs, uploaded files, web search and web fetch; count tokens; manage files; and send message batches at half the price.
anthropic - Azure OpenAIMessage the models deployed in an Azure OpenAI (Microsoft Foundry) resource, ask about images, and create embeddings.
azureopenai - DeepLTranslate text and documents with DeepL, keep glossaries, improve text with DeepL Write, and check the account's usage.
deepl - DeepSeekMessage DeepSeek's models with or without thinking mode, ask about images, and check the account balance.
deepseek - ElevenLabsTurn text into lifelike speech and recordings into text with ElevenLabs, and look up voices, models, past generations and the account's usage.
elevenlabs - Google GeminiAsk Gemini for text or JSON about text, images, audio, documents and video; generate and edit images; generate videos; make embeddings; and manage files and file search stores.
googlegemini - GroqMessage the open models Groq serves, ask about images, and turn speech into text with Whisper.
groq - Mistral AIChat with Mistral models (text, images, JSON), extract text from PDFs and images with Mistral OCR, make embeddings, check text for policy violations, transcribe and speak audio with Voxtral, run agents, and manage files.
mistralai - OllamaMessage models on your own Ollama server or Ollama's cloud, ask about images, create embeddings, and manage the server's models.
ollama - OpenAIAsk OpenAI models for text or JSON (with files, images, web search and code interpreter), check text for policy violations, make embeddings, generate and edit images, turn text into speech, transcribe and translate audio, and manage files and conversations.
openai - OpenRouterMessage models from many providers through one OpenRouter key, with fallbacks, provider routing and web search; create embeddings; check costs and credit.
openrouter - PerplexityGet cited, web-searched answers from Perplexity's agent, search the web, and create embeddings.
perplexity - ActiveCampaignKeep ActiveCampaign contacts, accounts and deals up to date, put contacts on lists, tags and automations, and sync e-commerce customers and orders.
activecampaign, activecampaigntrigger - BrevoSend transactional email and SMS through Brevo, keep contacts, lists and attributes up to date, and create and send email campaigns.
brevo, brevotrigger - CalendlyRead and cancel Calendly bookings, book invitees, mark no-shows, make single-use scheduling links, and read event types and availability.
calendly, calendlytrigger - DiscordSend, edit, pin and react to messages from your Discord bot or a channel webhook, and manage channels, members, roles, timeouts and bans.
discord - Email (IMAP)Read, search and manage email in an IMAP mailbox.
imap - Email (SMTP)Send email through an SMTP server.
email - FreshdeskCreate, update and find Freshdesk tickets, reply and add notes, and manage contacts and companies.
freshdesk, freshdesktrigger - GmailSend, read and label email in Gmail.
gmail, gmailtrigger - Google ContactsCreate, find, update and delete contacts in Google Contacts, and sort them into labels.
googlecontacts - IntercomManage Intercom contacts and companies, reply to, assign and close conversations, handle tickets, and publish help center articles.
intercom, intercomtrigger - KlickTippSubscribe, update, tag and untag contacts in KlickTipp, find them by email, and manage tags, opt-in processes and data fields.
klicktipp, klicktipptrigger - MailchimpAdd, update and tag audience members, create, schedule and send campaigns, manage templates, and read campaign reports in Mailchimp.
mailchimp, mailchimptrigger - MailerLiteAdd, update and find subscribers in MailerLite, sort them into groups, manage custom fields, and create, schedule and read campaigns.
mailerlite, mailerlitetrigger - Microsoft OutlookSend, find and organize mail in Outlook, work with drafts, attachments and folders, and manage calendar events and contacts.
microsoftoutlook, outlooktrigger - Microsoft TeamsPost and read messages in Teams channels and chats, ask for an approval in a chat, manage channels, chat members, online meetings and Planner tasks, and send activity feed notifications.
microsoftteams, teamstrigger - SendGridSend email through SendGrid, with attachments and dynamic templates, and manage Marketing Campaigns contacts and lists.
sendgrid - SlackPost, schedule, update and search messages, manage channels, upload files, react, and look up users and user groups in Slack.
slack, slacktrigger - TelegramSend messages, photos, documents, albums, polls and rich messages from a Telegram bot, edit, pin and react to messages, manage chats and download files.
telegram, telegramtrigger - TwilioSend SMS, MMS and WhatsApp messages and place calls with Twilio, look up phone numbers, and send and check verification codes.
twilio, twiliotrigger - WhatsApp BusinessSend WhatsApp messages: text, media, buttons, lists and approved templates. From your WhatsApp Business number, and upload and download media.
whatsapp, whatsapptrigger - ZendeskCreate, update and find Zendesk tickets, reply and add internal notes, apply macros, and manage users and organizations.
zendesk, zendesktrigger - bexioCreate and find contacts, write invoices (Rechnungen), quotes (Offerten) and orders (Aufträge) and issue, send or invoice them, download their PDF, book payments, and manage articles, projects, timesheets and manual entries in bexio.
bexio, bexiotrigger - Lexware OfficeCreate and find contacts and articles, write invoices (Rechnungen), quotations (Angebote), order confirmations, delivery notes, credit notes and dunnings as drafts or finalized and download their PDF, record bookkeeping vouchers (Belege) with their files, and read payments in Lexware Office (formerly lexoffice).
lexoffice, lexofficetrigger - PayPalTake and refund PayPal payments: orders, authorizations and captures, refunds, payouts, invoices and subscriptions.
paypal, paypaltrigger - sevdeskCreate and find contacts, write invoices (Rechnungen) and send, book or cancel them, create quotes, order confirmations and delivery notes, record vouchers (Belege) with their receipt, and manage parts, bank accounts and transactions in sevdesk.
sevdesk, sevdesktrigger - ShopifyManage a Shopify store: orders, products and variants, customers, inventory, locations and fulfillments.
shopify, shopifytrigger - StripeTake payments and manage billing in Stripe: payment intents, checkout sessions and payment links, customers, charges and refunds, invoices, subscriptions, products, prices and coupons.
stripe, stripetrigger - weclappCreate, find and change customers and contacts, articles, sales orders (Aufträge), invoices (Rechnungen), quotations (Angebote) and tickets in weclapp, download their PDF, and invoice an order.
weclapp, weclapptrigger - WooCommerceManage a WooCommerce store: orders, order notes and refunds, products and their variations, customers and coupons.
woocommerce, woocommercetrigger
API 88
- List workflowsWorkflows
GET/api/workflows - List tagsWorkflows
GET/api/workflows/tags - Create a workflowWorkflows
POST/api/workflows - Check a definitionWorkflows
POST/api/workflows/validate - Import a workflowWorkflows
POST/api/workflows/import - Preview an importWorkflows
POST/api/workflows/import/preview - Change many workflows at onceWorkflows
POST/api/workflows/bulk - Get a workflowWorkflows
GET/api/workflows/{id} - Update a workflow’s draftWorkflows
PUT/api/workflows/{id} - Delete a workflowWorkflows
DELETE/api/workflows/{id} - Export a workflowWorkflows
GET/api/workflows/{id}/export - Set a workflow’s tagsWorkflows
PUT/api/workflows/{id}/tags - Move a workflow to a folderWorkflows
PUT/api/workflows/{id}/folder - Duplicate a workflowWorkflows
POST/api/workflows/{id}/duplicate - Convert a Code step to 2.0.0Workflows
POST/api/code-steps/upgrade - List versionsPublish and versions
GET/api/workflows/{id}/versions - Publish a workflowPublish and versions
POST/api/workflows/{id}/publish - Review what publishing changesPublish and versions
GET/api/workflows/{id}/publish-review - Unpublish a workflowPublish and versions
POST/api/workflows/{id}/unpublish - Get a new webhook addressPublish and versions
POST/api/workflows/{id}/webhook/rotate - List variablesPublish and versions
GET/api/workflows/{id}/variables - Replace variablesPublish and versions
PUT/api/workflows/{id}/variables - Get a versionPublish and versions
GET/api/workflows/{id}/versions/{versionId} - Go back to a versionPublish and versions
POST/api/workflows/{id}/versions/{versionId}/restore - List runsRuns
GET/api/runs - List waiting runsRuns
GET/api/runs/waiting - List a workflow’s runsRuns
GET/api/workflows/{id}/runs - Get a runRuns
GET/api/runs/{id} - Delete a runRuns
DELETE/api/runs/{id} - Stream a runRuns
GET/api/runs/{id}/stream - Cancel a runRuns
POST/api/runs/{id}/cancel - Approve or reject a held runRuns
POST/api/runs/{id}/decision - Delete many runsRuns
POST/api/runs/delete - Run a workflowRuns
POST/api/workflows/{id}/run - Count a workflow’s waiting runsRuns
GET/api/workflows/{id}/runs/waiting - Cancel waiting runsRuns
POST/api/workflows/{id}/runs/cancel-waiting - Run a run againRuns
POST/api/runs/{id}/rerun - Run many runs againRuns
POST/api/runs/rerun - Cancel many runsRuns
POST/api/runs/cancel - Deliver to a webhookRuns
POST/api/webhooks/{token} - Group failed runsRun stats
GET/api/runs/failures - Runs in flightRun stats
GET/api/stats - Run summary with trendRun stats
GET/api/stats/summary - The last 7 daysRun stats
GET/api/stats/week - Overview figuresRun stats
GET/api/stats/overview - Runs over timeRun stats
GET/api/stats/timeseries - Count runs by stateRun stats
GET/api/runs/counts - Summarize a range of runsRun stats
GET/api/runs/range - Usual run timesRun stats
GET/api/runs/usual - List appsApps
GET/api/pieces - Catalog statusApps
GET/api/pieces/catalog-status - Get an appApps
GET/api/pieces/{id} - Get an action’s fieldsApps
GET/api/pieces/{id}/actions/{actionId} - Get a trigger’s fieldsApps
GET/api/pieces/{id}/triggers/{triggerId} - Get a field’s sub-fieldsApps
POST/api/pieces/{id}/actions/{actionId}/properties/{propertyName} - Get a field’s optionsApps
POST/api/pieces/{id}/actions/{actionId}/options/{propertyName} - Get a trigger’s sample dataApps
POST/api/pieces/{id}/triggers/{triggerId}/sample - Preview a scheduleApps
POST/api/pieces/schedule/next-runs - List connectionsConnections
GET/api/connections - Create a connectionConnections
POST/api/connections - See which workflows use each connectionConnections
GET/api/connections/usage - Test sign-in details before savingConnections
POST/api/connections/test - Start a sign-in for a new connectionConnections
POST/api/connections/oauth2/start - Check a sign-inConnections
GET/api/connections/oauth2/attempts/{attemptId} - Stop a sign-inConnections
POST/api/connections/oauth2/attempts/{attemptId}/cancel - Open a sign-in in this tabConnections
POST/api/connections/oauth2/attempts/{attemptId}/go - Get a connectionConnections
GET/api/connections/{id} - Rename or update a connectionConnections
PUT/api/connections/{id} - Delete a connectionConnections
DELETE/api/connections/{id} - Get a connection’s settingsConnections
GET/api/connections/{id}/settings - Test a connectionConnections
POST/api/connections/{id}/test - Move workflows to another connectionConnections
POST/api/connections/{id}/replace - Start a sign-in for a connectionConnections
POST/api/connections/{id}/oauth2/start - Check a connection’s sign-inConnections
GET/api/connections/{id}/oauth2/attempts/{attemptId} - List foldersFolders
GET/api/folders - Create a folderFolders
POST/api/folders - Rename or move a folderFolders
PUT/api/folders/{id} - Delete a folderFolders
DELETE/api/folders/{id} - List templatesTemplates
GET/api/templates - Save a workflow as a templateTemplates
POST/api/templates - Count templatesTemplates
GET/api/templates/count - Preview saving a templateTemplates
POST/api/templates/save-preview - Get a templateTemplates
GET/api/templates/{id} - Update a templateTemplates
PUT/api/templates/{id} - Delete a templateTemplates
DELETE/api/templates/{id} - Update a template’s stepsTemplates
PUT/api/templates/{id}/definition - Make a workflow from a templateTemplates
POST/api/templates/{id}/use - Preview using a templateTemplates
POST/api/templates/{id}/use/preview
Partner API 59
- Start a sessionSign-in
POST/api/embed/v1/sessions - Make a login codeSign-in
POST/api/embed/v1/login-codes - Check the installation can be embeddedSign-in
GET/api/embed/v1/bootstrap - End a sessionSign-in
DELETE/api/embed/v1/sessions/current - Turn switches off for a sessionSign-in
POST/api/embed/v1/sessions/current/turn-off - Renew a sessionSign-in
POST/api/embed/v1/sessions/current/renew - List accountsAccounts
GET/api/embed/v1/accounts - Get an accountAccounts
GET/api/embed/v1/accounts/{accountId} - Create or update an accountAccounts
PUT/api/embed/v1/accounts/{accountId} - Suspend an accountAccounts
POST/api/embed/v1/accounts/{accountId}/suspend - Resume an accountAccounts
POST/api/embed/v1/accounts/{accountId}/resume - Restore an accountAccounts
POST/api/embed/v1/accounts/{accountId}/restore - Delete an accountAccounts
DELETE/api/embed/v1/accounts/{accountId} - List an account’s tokensTokens
GET/api/embed/v1/accounts/{accountId}/tokens - Make a tokenTokens
POST/api/embed/v1/accounts/{accountId}/tokens - Revoke a tokenTokens
DELETE/api/embed/v1/accounts/{accountId}/tokens/{tokenId} - List an account’s websitesWebsites
GET/api/embed/v1/accounts/{accountId}/websites - List allowed websitesWebsites
GET/api/embed/v1/websites - Replace an account’s websitesWebsites
PUT/api/embed/v1/accounts/{accountId}/websites - Allow a website for one accountWebsites
POST/api/embed/v1/accounts/{accountId}/websites - Allow a websiteWebsites
POST/api/embed/v1/websites - Stop allowing a website for one accountWebsites
DELETE/api/embed/v1/accounts/{accountId}/websites/{origin} - Stop allowing a websiteWebsites
DELETE/api/embed/v1/websites/{origin} - List workspacesWorkspaces
GET/api/embed/v1/accounts/{accountId}/workspaces - Get a workspaceWorkspaces
GET/api/embed/v1/accounts/{accountId}/workspaces/{workspaceId} - Create or rename a workspaceWorkspaces
PUT/api/embed/v1/accounts/{accountId}/workspaces/{workspaceId} - Delete a workspaceWorkspaces
DELETE/api/embed/v1/accounts/{accountId}/workspaces/{workspaceId} - List an account’s membersPeople
GET/api/embed/v1/accounts/{accountId}/members - Get a personPeople
GET/api/embed/v1/users/{userId} - Give a person a rolePeople
PUT/api/embed/v1/accounts/{accountId}/members/{userId} - Create or update a personPeople
PUT/api/embed/v1/users/{userId} - Remove a memberPeople
DELETE/api/embed/v1/accounts/{accountId}/members/{userId} - Delete a personPeople
DELETE/api/embed/v1/users/{userId} - List connectionsConnections
GET/api/embed/v1/accounts/{accountId}/connections - Get a managed connectionConnections
GET/api/embed/v1/accounts/{accountId}/connections/{connectionKey} - Check how a connection sign-in endedConnections
GET/api/embed/v1/accounts/{accountId}/connections/oauth2/attempts/{attemptId} - Create or replace a managed connectionConnections
PUT/api/embed/v1/accounts/{accountId}/connections/{connectionKey} - Start a connection sign-in from your own buttonConnections
POST/api/embed/v1/accounts/{accountId}/connections/oauth2/start - Delete a managed connectionConnections
DELETE/api/embed/v1/accounts/{accountId}/connections/{connectionKey} - List templates customers can installWorkflows
GET/api/embed/v1/templates - List workflowsWorkflows
GET/api/embed/v1/accounts/{accountId}/workflows - Get a workflowWorkflows
GET/api/embed/v1/accounts/{accountId}/workflows/{workflowId} - Install a templateWorkflows
POST/api/embed/v1/accounts/{accountId}/workflows - Enable a workflowWorkflows
POST/api/embed/v1/accounts/{accountId}/workflows/{workflowId}/enable - Disable a workflowWorkflows
POST/api/embed/v1/accounts/{accountId}/workflows/{workflowId}/disable - Cancel a workflow’s waiting runsWorkflows
POST/api/embed/v1/accounts/{accountId}/workflows/{workflowId}/cancel-waiting - List runsRuns
GET/api/embed/v1/accounts/{accountId}/runs - Get a runRuns
GET/api/embed/v1/accounts/{accountId}/runs/{runId} - Cancel a runRuns
POST/api/embed/v1/accounts/{accountId}/runs/{runId}/cancel - Run a run againRuns
POST/api/embed/v1/accounts/{accountId}/runs/{runId}/rerun - List every account’s usageUsage
GET/api/embed/v1/usage - Get an account’s usageUsage
GET/api/embed/v1/accounts/{accountId}/usage - List an account’s AI appsAI apps
GET/api/embed/v1/accounts/{accountId}/ai-apps - Read a sign-in requestAI apps
GET/api/embed/v1/oauth-requests/{requestId} - Sign a person in for an AI appAI apps
POST/api/embed/v1/oauth-requests/{requestId}/complete - Turn a sign-in request downAI apps
POST/api/embed/v1/oauth-requests/{requestId}/deny - Disconnect an AI appAI apps
DELETE/api/embed/v1/accounts/{accountId}/ai-apps/{grantId} - Disconnect an account’s AI appsAI apps
POST/api/embed/v1/accounts/{accountId}/ai-apps/revoke - Disconnect every AI appAI apps
POST/api/embed/v1/ai-apps/revoke
Settings 147
PUBLIC_URLThe full address people open, such as https://automations.example.com, with the port when it is not 443..envENCRYPTION_KEYOpens every password, API key and connection GoRunner stores: 64 hexadecimal characters (openssl rand -hex 32)..envGORUNNER_ROLEall: everything on this server.default allPOSTGRES_PASSWORDThe built-in database's password..envREDIS_PASSWORDThe built-in queue's password..envS3_ACCESS_KEYThe keys of the built-in object storage (S3)..envS3_SECRET_KEYThe keys of the built-in object storage (S3)..envGORUNNER_PROXY_MODEHow people reach GoRunner..envGORUNNER_APP_BINDOnly with your own proxy: where it reaches GoRunner, [IP:]PORT..envAPP_TRUSTED_PROXIESWho may tell GoRunner the caller's address..envGORUNNER_DOMAINThe name people open, such as automations.example.com..envGORUNNER_TLSacme (the default): a free certificate from Let's Encrypt.default acmeGORUNNER_HSTSon: every page tells browsers to use https for this address for a year (Strict-Transport-Security: max-age=31536000, this name only, not its subdomains). The setup writes on when it gets a certificate from Let’s Encrypt.default offPUBLIC_HTTP_PORTThe server ports Caddy listens on.default 80PUBLIC_HTTPS_PORTThe server ports Caddy listens on.default 443GORUNNER_TRUSTED_PROXIESOnly when a proxy of yours stands in front of Caddy: that proxy's own address or range..envGORUNNER_EDGE_NETThe private networks GoRunner keeps for Caddy, as three numbers such as 172.29.253: one joins Caddy to the app, the other carries Caddy's published ports..envRESEND_API_KEYA Resend API key. Used when set..envSMTP_HOSTAny SMTP server, used when there is no Resend key..envSMTP_PORTAny SMTP server, used when there is no Resend key.default 587SMTP_USERAny SMTP server, used when there is no Resend key..envSMTP_PASSWORDAny SMTP server, used when there is no Resend key..envSMTP_SECUREHow the connection is encrypted..envMAIL_FROMThe sender, such as GoRunner <no-reply@example.com>..envGORUNNER_ADMIN_EMAILOptional. Set it, and only this address can create the first admin account, even with the setup code..envAUTH_ENABLEDtrue. Leave it: GoRunner refuses to start without sign-in on a server..envALLOW_SIGNUPfalse: nobody can sign up on their own, and people join by invitation..envADMIN_EMAIL_REQUIREDtrue: with GORUNNER_ADMIN_EMAIL empty, nobody may create the first admin..envPLATFORM_ADMIN_SECRETNot set by default, which keeps it closed..envLICENSE_KEYNot needed: load the license in the dashboard instead, or paste it when the setup asks..envGORUNNER_POSTGRESbundled: the built-in database on this server..envPOSTGRES_HOSTYour own database, as separate fields..envPOSTGRES_PORTYour own database, as separate fields..envPOSTGRES_DBYour own database, as separate fields..envPOSTGRES_USERYour own database, as separate fields..envPOSTGRES_PASSWORDYour own database, as separate fields..envPOSTGRES_SSLMODEdisable, require, verify-ca or verify-full..envPOSTGRES_CA_FILEThe certificate authority to check the database's certificate with, as a file in certs/: /certs/rds.pem..envDATABASE_URLYour own database as one address instead, such as postgresql://user:password@host:5432/gorunner?sslmode=require..envPOSTGRES_MAX_CONNECTIONSThe built-in database's connection limit.default 200GORUNNER_REDISbundled or external, as for the database..envREDIS_HOSTYour own Redis, as separate fields..envREDIS_PORTYour own Redis, as separate fields..envREDIS_DBYour own Redis, as separate fields..envREDIS_USERYour own Redis, as separate fields..envREDIS_PASSWORDYour own Redis, as separate fields..envREDIS_TLStrue for an encrypted connection, as most managed Redis services need..envREDIS_URLYour own Redis as one address instead, such as redis://user:password@host:6379/0 (rediss:// for TLS)..envGORUNNER_STORAGEbundled: the built-in object storage (S3)..envS3_ENDPOINTYour bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1)..envS3_BUCKETYour bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1).default gorunnerS3_REGIONYour bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1).default us-east-1S3_FORCE_PATH_STYLEtrue for MinIO and SeaweedFS, false for AWS S3..envSTORAGE_INLINE_THRESHOLD_KBStep data larger than this many KB goes to storage; smaller stays in the database.default 0S3_OP_TIMEOUT_SECONDSHow long one storage call may take (15 seconds), and how often it is tried (4)..envS3_MAX_ATTEMPTSHow long one storage call may take (15 seconds), and how often it is tried (4)..envAWS_REQUEST_CHECKSUM_CALCULATIONwhen_required, for an S3-compatible store that refuses the checksums newer AWS clients add..envAWS_RESPONSE_CHECKSUM_VALIDATIONwhen_required, for an S3-compatible store that refuses the checksums newer AWS clients add..envWORKER_REPLICASHow many worker containers run on this server.default 1WORKER_CONCURRENCYHow many runs one worker runs at once.default 4WORKER_INTERACTIVE_CONCURRENCYHow many Test step and connection tests from the editor one worker serves at once.default 2KEEL_CONCURRENCYHow many Keel conversations one worker serves at once.default 2NOTIFY_CONCURRENCYHow many notifications to your server one worker sends at once.default 4WORKER_MEMORY_LIMITThe memory one worker may use.default 2gWORKER_STOP_GRACEHow long a worker may finish its runs during an update before it is stopped.default 300sAPI_MEMORY_LIMITThe memory each of the app's two copies may use.default 1gDB_MAX_CONNSThe most database connections each GoRunner process keeps. The setup and the update size it from the check; empty means 50.default 50DB_ADMIN_HEADROOMHow many database connections the check keeps free beside GoRunner's own, for pg_dump and an administrator's session.default 5DB_MIN_CONNSThe fewest each process keeps open.default 5GOMEMLIMITA soft memory goal for every GoRunner process, below the memory limits above, such as 900MiB.default noneTZThe time zone of the processes' logs, and of the time a password lockout ends.default UTCWORKFLOW_PRIVATE_NETWORKSEmpty (the default): no private address..envHTTPS_PROXYThe proxy for everything GoRunner calls outside, such as http://user:password@proxy.example.com:3128..envHTTP_PROXYThe proxy for everything GoRunner calls outside, such as http://user:password@proxy.example.com:3128..envNO_PROXYNames reached directly, separated by commas..envEGRESS_PROXY_CONNECTname (the default) or ip: what the proxy is asked to connect to, for the addresses other people chose..envRUN_RETENTION_DAYSRuns that finished longer ago than this are deleted every hour, with their data.default 90AUDIT_RETENTION_DAYSAudit log rows older than this many days are deleted every hour.default 0AUDIT_CREDENTIAL_USE_RETENTION_DAYSCredential use GoRunner itself recorded (a run, a schedule or a poll using a connection) older than this many days is deleted every hour.default 0EVENT_STREAMING_ENABLEDfalse stops every organization's event streaming on this installation.default trueMAX_STEP_OUTPUT_BYTESThe largest input or output one step may hold.default 16 MBAPI_RATE_LIMITRequests a minute to the API for one caller: an API token, a signed-in session or an embed session, else one address.default 1200WEBHOOK_RATE_LIMITRequests a minute from one address to webhooks, and to a connection sign-in’s launch and return pages.default 3000OAUTH_RATE_LIMITRequests a minute from one address to AI app sign-in: discovery, register, authorize and token.default 120EMBED_API_RATE_LIMITRequests a minute for one embed API key, counted across every app process.default 3000EMBED_ACCOUNT_RATE_LIMITRequests a minute for one embedded account, counted across every app process.default 300EMBED_PERSON_RATE_LIMITLogin codes a minute for one person of one embedded account, so one page reloading in a loop stops at that person.default 20EMBED_RENEW_RATE_LIMITRenewals a minute for one embed session and the sessions renewed from it.default 4EMBED_SESSION_MAX_HOURSHow long the embed may keep renewing its own session after a login code, from 1 to 24 hours.default 12API_CORS_ORIGINSOther websites allowed to call the API from a browser, separated by commas.default noneRUNS_WAITING_PER_ORGHow many runs of one organization may wait in line for a free slot.default 10000RUNS_WAITING_PER_WORKFLOWHow many runs of one workflow may wait in line, so one flooded webhook cannot fill its organization's room.default 1000LOG_LEVELHow much the log says: debug, info, warn or error.default infoLOG_FORMATtext, or json for a log collector.default textOTEL_EXPORTER_OTLP_ENDPOINTYour OpenTelemetry tool's address and key: metrics, traces and logs.default not setOTEL_EXPORTER_OTLP_HEADERSYour OpenTelemetry tool's address and key: metrics, traces and logs.default not setOTEL_SERVICE_NAMEThe name GoRunner appears under in your tool.default gorunner-api, gorunner-workerOTEL_TRACES_SAMPLERKeep fewer traces on a busy installation.default every traceOTEL_TRACES_SAMPLER_ARGKeep fewer traces on a busy installation.default every traceMETRICS_ENABLEDA /metrics page for Prometheus, inside the Docker network, behind the token.default offMETRICS_TOKENA /metrics page for Prometheus, inside the Docker network, behind the token.default offSENTRY_DSNCrashes and errors to your Sentry project.default not setACCESS_LOGtrue: the app's line for each request also names the caller's address (as your proxy reported it, from a trusted proxy only) and its browser, and requests for unknown addresses are logged too.default offGORUNNER_ACCESS_LOGWith automatic HTTPS, on: Caddy writes one line for each request with the caller's address.default offHEALTH_DETAILS/api/health and /api/ready say only ok or unavailable to anyone but the server itself.default not setOAUTH_MANAGED_GOOGLE_CLIENT_IDNot needed: set up the Google sign-in app under Platform › Settings › OAuth apps instead, which takes its place..envOAUTH_MANAGED_GOOGLE_CLIENT_SECRETNot needed: set up the Google sign-in app under Platform › Settings › OAuth apps instead, which takes its place..envOUTBOUND_ALLOW_PRIVATEOff. Notification addresses and your own OAuth apps' token addresses must be https on the public internet..envKEEL_COMPILEEmpty. off: the assistant builds without its compile step..envGORUNNER_TAGThe installed version..envGORUNNER_REGISTRYWhere the images come from, such as registry.example.com/ralve-org.default ghcr.io/ralve-orgCOMPOSE_PROFILESWhat runs on this server: the role, one name for each built-in store (postgres, redis, storage), and caddy with automatic HTTPS..envGORUNNER_GATE_TAGWritten by the setup and the update (the relay's tag by the update only) for two small containers that must never restart during an update: the one that holds the app's address open, and the one in front of the object storage..envGORUNNER_GATE_SYSCTLThe kernel setting of the container that holds the app’s address open. The update writes it.default net.ipv4.tcp_migrate_req=1GORUNNER_RELAY_TAGWritten by the setup and the update (the relay's tag by the update only) for two small containers that must never restart during an update: the one that holds the app's address open, and the one in front of the object storage..envCOMPOSE_PROJECT_NAMEThe prefix of the container and volume names..envWORKER_RUN_GATEoff: a worker takes runs while it has slots, whatever its memory and sandbox say..envEMBED_OAUTH_REQUEST_RATE_LIMITRequests a minute for one embed API key to the AI app sign-in requests (oauth-requests/*), counted across every app process, in their own window apart from EMBED_API_RATE_LIMIT. A Docker install passes it to the app from v2026.10.31; before, only the default applied.default 600SCRIPT_MEMORY_LIMIT_MBMemory one Code step or {{ }} expression may use, in MB (256; 64 to 16384).default 256GORUNNER_JSBOX_SEALThe sandbox around Code steps and expressions..envGORUNNER_JSBOX_SHIP_ALL1: hand every script every earlier step, instead of only the ones it reads..envAPI_INFLIGHT_MBRequest bodies and whole payload reads one API holds at once, in MB (0: no limit).default 256SYNC_WAITS_MAXSynchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.default 4096SYNC_WAITS_PER_ORGSynchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.default 512SYNC_ANSWER_MBSynchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.default 128AUDIT_IP_RETENTION_DAYSThe client IP address on audit rows older than this many days is removed hourly; the rows stay.default 0OTEL_EXPORTER_OTLP_PROTOCOLhttp/protobuf (default) or grpc.default http/protobufOTEL_EXPORTER_OTLP_TRACES_ENDPOINTOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_EXPORTER_OTLP_TRACES_HEADERSOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_EXPORTER_OTLP_METRICS_ENDPOINTOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_EXPORTER_OTLP_METRICS_HEADERSOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_EXPORTER_OTLP_LOGS_ENDPOINTOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_EXPORTER_OTLP_LOGS_HEADERSOne signal elsewhere: a full address (used as given) and its own headers..envOTEL_TRACES_EXPORTERnone turns one signal off (default otlp).default otlpOTEL_METRICS_EXPORTERnone turns one signal off (default otlp).default otlpOTEL_LOGS_EXPORTERnone turns one signal off (default otlp).default otlpOTEL_RESOURCE_ATTRIBUTESExtra resource attributes, key=value,key=value, such as team=platform..envOTEL_METRIC_EXPORT_INTERVALHow often metrics are pushed, in milliseconds.default 60000OTEL_SDK_DISABLEDtrue: OpenTelemetry never starts, whatever else is set.default falseTELEMETRY_DB_SPANSDatabase and Redis calls as spans (they multiply trace volume), and a traceparent header on the HTTP calls steps make.default falseTELEMETRY_PROPAGATE_OUTBOUNDDatabase and Redis calls as spans (they multiply trace volume), and a traceparent header on the HTTP calls steps make.default falseMETRICS_ADDRA /metrics page for Prometheus on every API and worker container (port 9464 on this network, not published).default :9464METRICS_WORKFLOW_LABELSAdd workflow_id to the run and step metrics (one series per workflow: costly).default falseSENTRY_ENVIRONMENTCrashes and errors (the server's, and the dashboard's relayed through it) to Sentry.default productionCLIENT_ERRORS_ENABLEDfalse: drop the dashboard's browser error reports instead of logging them.default trueOAUTH_PUBLIC_CORSAI apps that sign in with OAuth (ChatGPT, Claude, VS Code, Cursor…): their discovery documents, /oauth/register, /oauth/token and /oauth/revoke answer any website (CORS *, no cookies), so an app running in a browser can sign in.default onOAUTH_EXTRA_REDIRECT_URISMore app callbacks AI apps may register: whole URIs, comma-separated, no query, for an app whose callback GoRunner does not know (https, loopback, Cursor's and Raycast's need nothing here)..env
Helm values 99
image.repositoryWhere the image comes from. Change it for a mirror inside your company.values.yamlimage.tagThe version to run. Leave it empty: each chart version runs its own release.values.yamlimage.digestsha256:… pins the exact image, and wins over the tag.values.yamlimage.pullPolicyWhen the cluster downloads the image again.values.yamlimagePullSecretsThe Secret with the registry’s user name and token, such as [{name: ghcr}]. GoRunner’s image is private, so this is needed. The chart is private for now too: sign Helm in first (helm registry login ghcr.io). Every pod that runs GoRunner’s image uses it, the bundled file store’s relay included.values.yamlpublicUrlThe address people open. Every email, approval page and OAuth redirect is built from it. Empty: ingress.host, with https when ingress.tls.enabled.values.yamlingress.enabledMake an Ingress. Off: route to the <release>-api Service yourself, on port 80.values.yamlingress.classNameThe IngressClass, such as nginx, traefik or alb. Empty: the cluster’s default.values.yamlingress.hostThe domain name. Required with an Ingress.values.yamlingress.pathGoRunner needs the whole host; a sub-path isn’t supported. With ingress.pathType, Prefix.values.yamlingress.tls.enabledServe the address over https. Turn it on unless something in front ends https.values.yamlingress.tls.secretNameThe certificate’s Secret, or the one cert-manager writes.values.yamlingress.nginxDefaultsWith className: nginx: no response buffering, an hour’s read and send timeout, and a 6 MiB body.values.yamlapi.trustedProxiesWho may name the caller’s address. Empty trusts every private address, safe only while the network policy is on.values.yamladmin.emailOnly this address can make the first account. Optional without existingSecret; with it, see admin.allowOpenFirstSignup. It does nothing once an account exists.values.yamladmin.allowOpenFirstSignupWith existingSecret and no admin.email: true lets whoever has the setup code be first.values.yamlauth.allowSignupfalse: people join by invitation. true: anyone who can open the address can make an account.values.yamldeployModeLeave it.values.yamlexistingSecretYour own Secret, its keys the setting names. Set, the chart writes none, and every secret value here is ignored.values.yamlencryptionKey64 hex characters (openssl rand -hex 32). Opens every stored credential. The chart never makes one up.values.yamllicenseKeyThe license. Optional: the first admin is asked for one after signing in. One loaded in the dashboard comes first while in force.values.yamlplatformAdminSecretThe key to the operator console at /admin. Empty keeps it closed; set it only when GoRunner asks.values.yamlmail.backendnone: people sign in with a password. resend or smtp: sign-in by emailed link.values.yamlmail.fromThe sender, on a domain your mail service may send for.values.yamlmail.resendApiKeyWith backend: resend.values.yamlmail.smtp.hostWith backend: smtp.values.yamlmail.smtp.port587, or 465 for TLS from the first byte.values.yamlmail.smtp.securestarttls, tls or none. Empty: tls on 465, otherwise STARTTLS.values.yamlmail.smtp.userWith mail.smtp.password. Leave both empty for a server with no sign-in.values.yamlpostgresql.urlYour database, PostgreSQL 15 or newer, as one address. It wins over the fields below.values.yamlpostgresql.hostThe host alone, without its port. With port (5432), database (gorunner), user and password.values.yamlpostgresql.sslmodedisable, require, verify-ca or verify-full.values.yamlpostgresql.caFileThe CA for verify-ca or verify-full, as a path in the pods, such as /certs/rds.pem.values.yamlpostgresql.maxConnectionsPerProcessThe most connections each pod keeps (DB_MAX_CONNS). All pods, plus one of each while an upgrade rolls, must fit max_connections.values.yamlpostgresql.adminHeadroomConnections the check keeps free for backups and an admin, at least 5.values.yamlpostgresql.bundled.enabledRun the chart’s own PostgreSQL 15.6: one pod, an 8Gi volume, no backups. Evaluation only.values.yamlredis.urlYour Redis 6.2 or newer as one address, rediss:// for TLS. Not in cluster mode, with noeviction.values.yamlredis.hostSeparate fields: port (6379), db (0), user, password.values.yamlredis.tlstrue for an encrypted connection.values.yamlredis.bundled.enabledRun the chart’s own Redis: one pod, a 2Gi volume, no replica. Evaluation only.values.yamlobjectStorage.modenone: step data stays in PostgreSQL. external: your bucket. bundled: one SeaweedFS pod, evaluation only.values.yamlobjectStorage.bucketWith objectStorage.region, us-east-1.values.yamlobjectStorage.inlineThresholdKBStep data larger than this goes to the bucket. 0: all of it.values.yamlobjectStorage.opTimeoutSecondsHow long one storage call may take. maxAttempts: how often it is tried, 4.values.yamlobjectStorage.external.endpointYour store’s address.values.yamlobjectStorage.external.forcePathStyletrue for MinIO and SeaweedFS.values.yamlobjectStorage.external.accessKeyWith secretKey.values.yamlpostgresql.bundled.image.tagdocker.io/library/postgres (image.repository). image.digest is empty: a new image string would restart the database. Set it yourself to pin one.values.yamlredis.bundled.image.tagdocker.io/library/redis. The release sets image.digest to the one the tag named when it was tested.values.yamlobjectStorage.bundled.image.tagdocker.io/chrislusf/seaweedfs, with its digest set by the release.values.yamlpostgresql.bundled.persistence.sizeRedis 2Gi, SeaweedFS 10Gi. Each also takes persistence.storageClass (empty: the cluster’s default) and resources.values.yamlpostgresql.bundled.passwordAlso redis.bundled.password and objectStorage.bundled.accessKey / secretKey. Empty: made once and kept in the <release>-bundled Secret, which outlives an uninstall.values.yamlapi.replicasKeep at least 2, so a drain or a crash never leaves nobody to answer.values.yamlapi.resourcesCPU and memory for each.values.yamlapi.runRetentionDaysRuns that finished longer ago than this are deleted hourly, with their data. Each workflow keeps its newest finished run in each environment.values.yamlapi.rateLimits.apiRequests a minute per credential. Also webhook 3000, oauth 120, embedApi 3000, embedAccount 300, embedOauthRequest 600 (from v2026.10.31), embedPerson 20, embedRenew 4.values.yamlapi.embedSessionMaxHoursHow long the embed renews its own session, 1 to 24 hours.values.yamlapi.corsOriginsOther websites that may call the API from a browser, separated by commas.values.yamlapi.oauthPublicCorsoff: AI apps’ sign-in addresses (discovery, register, token, revoke) keep the API’s own CORS instead of answering any website. For an installation reached only from your own network (OAUTH_PUBLIC_CORS, from v2026.10.31).values.yamlapi.oauthExtraRedirectUrisMore app callbacks AI apps may register: whole addresses, separated by commas, no query (OAUTH_EXTRA_REDIRECT_URIS, from v2026.10.31).values.yamlapi.accessLogAdds the caller’s address and browser to each request’s line (ACCESS_LOG).values.yamlapi.healthDetailspublic: health checks show their details to anyone (HEALTH_DETAILS).values.yamlapi.terminationGracePeriodSecondsWhen a pod stops, how long it has to finish requests, after preStopSeconds (10).values.yamlapi.pdb.enabledKeep at least minAvailable (1) app pod through node drains.values.yamlapi.service.typeThe Service in front of the app, on port 80, with annotations of your own.values.yamlapi.extraEnvMore environment variables for the app pods, as a Kubernetes env list.values.yamlworker.replicasMore workers is the safer way to grow than larger ones.values.yamlworker.concurrencyRuns one worker runs at once. Raise its memory limit with it.values.yamlworker.resourcesCPU and memory for each.values.yamlworker.keelConcurrencyKeel conversations one worker serves at once. 0 turns Keel off on it.values.yamlworker.keelCompileoff: Keel builds without its compile step. Leave it unless GoRunner asks.values.yamlworker.notifyConcurrencyNotifications to your server one worker sends at once.values.yamlworker.interactiveConcurrencyTest step and connection tests one worker serves at once.values.yamlworker.terminationGracePeriodSecondsHow long a stopping worker may finish its runs. After that, another worker picks them up.values.yamlworker.extraEnvAnd the same placement values as the app.values.yamlworkflows.waitingPerOrgRuns of one organization that may wait before new ones are refused. 0: no cap.values.yamlworkflows.waitingPerWorkflowThe same for one workflow, editor test runs included.values.yamlmigrate.job.enabledRun the migrations Job at every install and upgrade. Leave it on.values.yamlmigrate.job.argsExtra flags, only when GoRunner asks.values.yamlmigrate.job.backoffLimitRetries. activeDeadlineSeconds: 900 in all.values.yamlmigrate.job.ttlSecondsAfterFinishedThe finished Job and its log go after a day.values.yamlmigrate.resourcesCPU and memory for the Job.values.yamlcheck.enabledA problem the check finds fails the Job. false: only logged, except one that protects data.values.yamlproxy.httpsWith proxy.http: the proxy’s address, kept in the Secret.values.yamlproxy.noProxyNames reached directly. GoRunner adds its own, the cluster’s .svc and .cluster.local among them.values.yamlextraVolumesMore volumes on every pod, with extraVolumeMounts. Every .pem mounted at /certs is trusted.values.yamltelemetry.logLevelLOG_LEVEL. And logFormat: LOG_FORMAT.values.yamltelemetry.otel.endpointOTEL_EXPORTER_OTLP_ENDPOINT. Each telemetry.otel.* value is the OTEL_* setting of the same meaning; headers is kept in the Secret.values.yamltelemetry.metrics.enabledMETRICS_ENABLED: /metrics on port 9464 of every pod, with token and workflowLabels.values.yamltelemetry.sentry.dsnSENTRY_DSN, kept in the Secret, with environment.values.yamltelemetry.clientErrorsEnabledCLIENT_ERRORS_ENABLED. Also auditRetentionDays, auditCredentialUseRetentionDays, auditIpRetentionDays and eventStreamingEnabled.values.yamlserviceAccount.createGoRunner never calls the Kubernetes API, so the account holds no token. Also name and annotations.values.yamlpodSecurityContextWith the default seccomp profile.values.yamlsecurityContextNo privilege escalation, every capability dropped.values.yamlnetworkPolicy.enabledOnly your controller and helm test reach the app; the workers accept nothing. Needs a plugin that enforces NetworkPolicy.values.yamlnetworkPolicy.apiFromWho may reach the app. Change it for any other controller, or the app answers nobody.values.yamlnetworkPolicy.metricsFromWho may read /metrics on port 9464.values.yamltests.enabledThe checks helm test runs.values.yamlnameOverrideWith fullnameOverride: other names for the chart’s objects.values.yaml
Metrics 21
gorunner_runs_started_totalRuns that started, by trigger and environment.countergorunner_runs_finished_totalRuns that ended or paused, by status (completed, failed, cancelled, paused) and environment.countergorunner_run_duration_secondsHow long a run took, to its end or its pause, by status.histogramgorunner_steps_finished_totalSteps that finished, by piece (the app, such as http; branch, loop or code) and status.countergorunner_step_duration_secondsHow long a step took, by piece.histogramgorunner_runs_pausedRuns waiting now, by reason: delay, approval or webhook. Counted once a minute.gaugegorunner_queue_waiting_jobsJobs waiting for a worker, by queue: jobs (runs) or rpc (editor work).gaugegorunner_queue_oldest_wait_secondsHow long the oldest waiting job has waited, by queue.gaugegorunner_dead_letter_jobsJobs that never reached a worker.gaugegorunner_worker_slots_busyThis worker’s run slots in use.gaugegorunner_worker_slots_totalThis worker’s run slots (WORKER_CONCURRENCY).gaugegorunner_redis_memory_used_bytesThe memory Redis uses, read by each API process every 15 seconds.gaugegorunner_redis_memory_limit_bytesRedis’s maxmemory. 0 means no limit.gaugegorunner_http_server_request_duration_secondsAPI requests, by http_route (the pattern), http_request_method, http_response_status_code and outcome.histogramgorunner_webhooks_received_totalWebhook deliveries, by outcome: accepted, rejected or sync_reply.countergorunner_client_errors_totalError reports from people’s browsers.countergorunner_connection_refresh_failures_totalOAuth connections whose token couldn’t be renewed, by piece.countergorunner_oauth_token_resource_mismatch_totalOAuth token requests for a resource the grant doesn’t cover (logged, not refused), by grant_type.countergorunner_events_streamed_totalTries to deliver streamed events, by kind (webhook, datadog, splunk, syslog, otlp) and outcome (delivered, failed).countergorunner_audit_events_totalAudit log rows written, by action.countergorunner_payload_deletes_totalStored step data the cleanup deleted, or failed to and will retry, by outcome: deleted, failed.counter
Errors 110
INVALID_BODYThe body is not valid JSON, or not the shape this call takes.400NOT_SUPPORTEDThis app declares no dynamic fields or options.400VALIDATION_ERRORA parameter or the body is not valid; the message names it.400EMBED_SESSION_ENDEDThe login code’s person no longer has that access (details.reason says why).401INVALID_CODEThe code is missing, unknown, used or expired.401TOKEN_ENDEDA token made inside a partner’s product stopped working: it was revoked or expired, its maker left or lost the editor role, or its account or workspace was deleted (details.reason says which). Make a new token.401UNAUTHORIZEDThe token is missing, expired or revoked.401ACCOUNT_SUSPENDEDThe workspace’s account is suspended. Nothing new starts until it is resumed, and its data is kept.403BROWSER_REQUIREDSigning in needs a person in a browser. An API token signs a connection in again through Start a sign-in for a new connection, with connectionId and returnUrl.403EMBED_NOT_ALLOWEDOnly an embedded session can do this. An AI app’s connection or a token can’t, and the embedded view can’t reach this part of the API.403EMBED_NOT_AVAILABLEEmbedding is not licensed here, or sign-in is off. The login code is not used up.403EMBED_NOT_LICENSEDThis installation's license does not include embedding.403FEATURE_OFFIn an embedded session, the switch this call needs is off (for example folders).403FORBIDDENThe token lacks the permission this call needs.403IP_NOT_ALLOWEDThe key's address allow-list does not include the caller.403KEEL_CLICK_REQUIREDKeel tried to publish without a person pressing its card. A person must press it.403MANAGED_CONNECTIONThe partner manages that connection, so it can’t be changed here.403ORG_LIMITThe license’s organization limit is reached.403ORIGIN_NOT_ALLOWEDThe page is not one of the allowed websites. The login code is not used up.403PIECE_NOT_ALLOWEDThe app is not one this workspace may use.403TOKEN_SURFACE_OFFThe token wasn’t made to work here: with the API, or with AI apps (details.surface says which).403WORKSPACE_LIMITThe license’s workspace limit is reached.403ALREADY_ANSWEREDAn approval link that was already answered. The run has moved on.404NOT_FOUNDNothing with that ID in this workspace, or a mistyped path.404OAUTH_REQUEST_NOT_FOUNDNo such sign-in request, or it expired.404STEP_NOT_FOUNDWith step: the run has no step of that name. The message lists the ones it has.404TIMED_OUTAn approval link whose wait timed out before anyone answered.404METHOD_NOT_ALLOWEDThe path exists, but not with this method.405ACCOUNT_DELETEDThe workspace’s account was deleted. Restore it first.409ACCOUNT_NOT_DELETEDThe account is not deleted, so there is nothing to restore.409ACCOUNT_SUSPENDEDThe account is suspended, so the run can’t be decided or run again now.409ALREADY_ANSWEREDThe approval was already answered.409ALREADY_RETRIEDIn Run many runs again’s results: that run already has a retry that worked or is still going, so it was left out.409BUSYSomething else held the thing this call needs, and the call gave up waiting. Nothing was done. Try again.409CONFLICTThe request clashes with the current state. If a request with the same Idempotency-Key is still in progress, retry shortly.409DEFAULT_WORKSPACEAn account’s default workspace can’t be deleted.409EDITING_ELSEWHEREThe workflow is being edited in another tab.409KEEL_PUBLISH_STALEA click on the assistant's publish card named no review, or a draft or base version that has moved since the card was shown.409NAME_TAKENA folder with that name is already in that place, or a workspace with that name is already in the organization.409NOT_A_MEMBERWith provision false, the person is not a member of the workspace.409NOT_WAITINGThe run is not waiting for an approval.409OAUTH_REQUEST_ACCOUNT_MISMATCHThe account is not the one the sign-in request is for. The request is not used up.409OAUTH_REQUEST_DONEThe sign-in request was already completed or turned down.409RENEW_REFUSEDThe session can’t be renewed (details.reason says why). Ask your server for a new login code.409RESTORE_EXPIREDThe account was deleted more than 30 days ago and can no longer be restored.409ROLE_DIFFERSWith provision false, the role is not the person’s role there.409RUN_NOT_FINISHEDThe run is queued, running or held. Cancel it first, or wait.409SIGNIN_NOT_PENDINGThe sign-in was already opened or has ended, or isn’t a tab sign-in. Start it again.409TOKEN_LIMITThe workspace already has 25 live tokens.409WEBSITE_EXISTSThe list already holds it.409WORKFLOW_NOT_LIVEA production run whose workflow is paused or a draft. No run is started.409WORKFLOW_NOT_PUBLISHEDThe workflow is not on, so it has nothing published to run.409PAYLOAD_TOO_LARGEThe body is larger than this call accepts.413INVALID_CONTENT_TYPEA Content-Type other than application/json (leaving it out is fine).415CONNECTION_MISMATCHA connection named for a slot is for another service (details.slot).422CONNECTION_TEST_FAILEDWith "test": true, the service refused the settings when tested, so nothing was saved (details.cause says why).422INVALID_ORIGINThe website can’t be allowed as written, or is a wildcard. A customer’s website is one exact address.422PIECE_NOT_ALLOWEDA step uses an app this workspace may not use. The message names the step.422RETURN_URL_NOT_ALLOWEDThe return address is not on an allowed website.422SECRETS_REQUIREDThe change moves a where field (a host, server, port, database, URL or connection string) while a stored secret was left blank.422SIGN_IN_ADDRESS_NOT_ALLOWEDThe AI app sign-in address is not on a website allowed for the installation or for this account.422TOO_MANY_WEBSITESThe list is full: 20 websites for one account, 200 for the installation (details.max says which).422VALIDATION_ERRORA rule the body breaks (the message names it), or an Idempotency-Key reused with a different body.422CONCURRENCY_LIMITThe workflow is at its concurrency limit and is set to Refuse. Try again when a run finishes.429RATE_LIMITEDToo many requests from this caller (an API token, a session or an embed session) or this address. Retry-After says when to try again.429RUNS_WAITING_LIMITToo many runs are already waiting in line, for the organization or for this workflow. Try again later.429TOO_MANY_STREAMSThis person or token already follows 50 runs on this server. Retry-After says when to try again.429DELETE_FAILEDThe delete did not happen, and the workflow is still there. Try again.500ENQUEUE_FAILEDThe approval could not be handed to a worker. The run is still held.500INTERNAL_ERRORSomething failed on the server. Try again.500RESOLVE_FAILEDThe Sub-flow step’s inputs, or the list of workflows to choose from, could not be read.500ACCOUNT_SUSPENDEDA webhook or form of a suspended account. Nothing ran. Retry-After says an hour.503BUSYThis server holds as much request data as it can right now. Nothing was done. Retry after Retry-After.503NO_VERDICTWith "test": true, no worker could test the connection, so nothing was saved. Try again (details.reason says why).503PAUSEDA self-hosted installation without a valid license is paused. Nothing is read, written or run. An API call gets no Retry-After: load a license. A webhook or form gets a Retry-After of an hour.503PIECES_UNAVAILABLEGoRunner couldn’t check which apps may run. Nothing started.503SERVICE_UNAVAILABLEThe database or Redis didn’t answer, so the request wasn’t checked and nothing was done. Retry after Retry-After.503STATE_UNAVAILABLEThe account's state could not be read, so nothing was started.503STORAGE_UNAVAILABLEA webhook that answers in the same call: the run finished, but its step output couldn’t be read back from storage. The run is intact. Retry, or read it with Get a run.503UNAVAILABLEThis server can’t do it now: no Redis to signal a cancel or record a sign-in, or the installation’s OAuth app for the service can’t be read.503WORKER_UNAVAILABLENo worker is checked in.503not_allowed_hereYour page's origin is not one of the installation's allowed websites (Platform › Partner keys › Allowed websites), or the page has no web origin at all (a file: page). The browser would block the frame, so the SDK refuses before it is made.SDKlicenceThe installation's license does not include Embed, or the installation is paused because its license ended.SDKunavailableEmbedding is turned off on the installation (sign-in is off), or nothing is switched on for this person, so there is no page to show them.SDKcode_failedgetCode threw, returned something that is not a code, or did not settle in time. The message carries your error's message.SDKcode_expiredThe installation refused the code, and the fresh one the frame asked for too: used, or older than 60 seconds. Check that your server asks for a new code on every call rather than handing out a cached one.SDKaccess_endedThe person no longer has access to this account: they were removed, or the account or the workspace was deleted. A new code for the same account will not help.SDKaccount_suspendedThis account is suspended: everything can be read, nothing can be changed or run. A warning: the frame stays open, and the error event has fatal: false.SDKnot_availableThe page you mounted is switched off for this person: “The page this embed was asked to open (/overview) is switched off here.” Mount without it, or with one that is on. The frame says this, so every SDK version gets it.SDKsession_failedThe session could not be renewed: the host page did not hand over a new sign-in code.SDKunreachableThe frame could not reach the installation while signing in.SDKcrashedThe frame hit an error it could not recover from.SDKversion_mismatchThe frame and the SDK share no protocol version. Load /embed.js from the installation, or upgrade the package.SDKtimeoutThe frame did not answer within timeoutMs. The commonest cause is your page's Content-Security-Policy not allowing the installation in frame-src. For a method, the frame did not reply within ten seconds.SDKcontainer_not_foundNo element matches the container selector, or the element given is not in the page.SDKinvalid_optionsAn option is missing or not what it should be; the message names it. Methods use it for an argument they cannot take, such as a theme that is not one.SDKunmountedunmount() was called, or the React component went away, before the mount finished. For a method: the instance was unmounted.SDKnot_readyThe embed is not ready: still mounting, reconnecting, or ended.SDKnot_allowedThe page is switched off for this person, or making connections is not available to them.SDKnot_configuredConnecting that service is not set up on the installation (no OAuth app for its provider).SDKinvalid_pageWhat you passed to navigate or switchAccount is not a page.SDKpiece_not_foundconnect named a service the installation does not have, or an app id that is not one.SDKbusyA connection dialog is already open, or the embed is already signing in.SDKinvalid_appearancesetAppearance was given something that is not a settings object, one over 16 KB, or one the frame refuses: a value outside the appearance settings, a font service's stylesheet, or an uploaded face whose file is not at the installation's own address or on your page's own website. An appearance in mount() that the frame refuses is ignored, and the embed shows your installation's look.SDKunsupportedThe frame answered without the result the method expects — an installation of another release than this SDK.SDKframe_reloadedThe frame document reloaded, or the embed switched account, while the call was waiting for its reply. Call it again once the embed is ready.SDKexit 0Nothing is wrong. Warnings are allowed.checkexit 1At least one problem. Each one names the line to change.checkexit 2The command line itself was wrong.checkexit 4At least one problem that protects data GoRunner already holds, such as an encryption key that is not the installation’s. Setup, deploy and a container’s start never go past it, even when told to skip the check.check